amazon s3的官方有一篇介绍文章，但是少了一个”,”，导致并不能成功导入。

amazon有提供policy的在线生成工具，地址是http://awspolicygen.s3.amazonaws.com/policygen.html

amazon针对用户共用bucket，指定用户目录的policy在https://aws.amazon.com/blogs/security/writing-iam-policies-grant-access-to-user-specific-folders-in-an-amazon-s3-bucket/

具体policy可以使用下方的policy

{
  "Version":"2012-10-17",
  "Statement": [
    {
      "Sid": "AllowGroupToSeeBucketListInTheConsole",
      "Action": ["s3:ListAllMyBuckets", "s3:GetBucketLocation"],
      "Effect": "Allow",
      "Resource": ["arn:aws:s3:::*"]
    },
    {
      "Sid": "AllowRootAnd<shared-folder-name>ListingOfCompanyBucket",
      "Action": ["s3:ListBucket"],
      "Effect": "Allow",
      "Resource": ["arn:aws:s3:::<bucket-name>"],
      "Condition":{"StringEquals":{"s3:prefix":["","<shared-folder-name>/"],"s3:delimiter":["/"]}}
    },
    {
      "Sid": "AllowListingOfUserFolder",
      "Action": ["s3:ListBucket"],
      "Effect": "Allow",
      "Resource": ["arn:aws:s3:::<bucket-name>"],
      "Condition":{"StringLike":{"s3:prefix":
                  [
                       "<shared-folder-name>/${aws:username}/*",
                       "<shared-folder-name>/${aws:username}"
                  ]
               }
        }
    },
    {
       "Sid": "AllowAllS3ActionsInUserFolder",
       "Action":["s3:*"],
       "Effect":"Allow",
       "Resource": ["arn:aws:s3:::<bucket-name>/<shared-folder-name>/${aws:username}/*"]
    }
  ]
}

但是其实只保留最后两段是比较安全的，这样子无论是/根目录还是<shared-folder-name>共享目录都是不可以list的，只能list用户自己的名字命名的文件夹。

{
  "Version":"2012-10-17",
  "Statement": [
    {
      "Sid": "AllowListingOfUserFolder",
      "Action": ["s3:ListBucket"],
      "Effect": "Allow",
      "Resource": ["arn:aws:s3:::<bucket-name>"],
      "Condition":{"StringLike":{"s3:prefix":
                  [
                       "<shared-folder-name>/${aws:username}/*",
                       "<shared-folder-name>/${aws:username}"
                  ]
               }
        }
    },
    {
       "Sid": "AllowAllS3ActionsInUserFolder",
       "Action":["s3:*"],
       "Effect":"Allow",
       "Resource": ["arn:aws:s3:::<bucket-name>/<shared-folder-name>/${aws:username}/*"]
    }
  ]
}

这样子可以非常安全的隔离用户，也不用为每个用户建立一个bucket桶，还是很方便的。经过奶牛的测试，ACL最好就用默认的private，这样子安全性会更高。