Support specifying a folder `--prefix` about s3-credentials HOT 5 CLOSED

{
 "Version":"2012-10-17",
 "Statement": [
   {
     "Sid": "AllowUserToSeeBucketListInTheConsole",
     // There doesn't seem to be a way to NOT let people see
     // the names of the other buckets in an account, while
     // still letting them access interfaces that show them
     // a list of buckets incluing the ones they can access
     //
     // s3:GetBucketLocation here is interesting - it lets you
     // see what region a bucket is in. I should add that to
     // my own policies.
     "Action": ["s3:ListAllMyBuckets", "s3:GetBucketLocation"],
     "Effect": "Allow",
     "Resource": "*"
   },
  {
     "Sid": "AllowRootAndHomeListingOfCompanyBucket",
     // Note that s3:ListBucket allows access to ListObjectsV2
     "Action": ["s3:ListBucket"],
     "Effect": "Allow",
     "Resource": ["arn:aws:s3:::my-company"],
     // Since this is StringEquals this is essentially saying
     // that permission is granted ONLy to make ListBucket calls
     // which either request / or request home/, and that the
     // delimiter must be set to /
     "Condition":{
       "StringEquals":{
         "s3:prefix":["","home/"],
         "s3:delimiter":["/"]
        }
      }
    },
   {
     "Sid": "AllowListingOfUserFolder",
     "Action": ["s3:ListBucket"],
     "Effect": "Allow",
     "Resource": ["arn:aws:s3:::my-company"],
     // This is the thing that allows ListBucket to be called
     // on home/David/ or any of its children
     "Condition": {
       "StringLike":{
         "s3:prefix": ["home/David/*"]
        }
      }
   },
   {
     "Sid": "AllowAllS3ActionsInUserFolder",
     "Effect": "Allow",
     // This seems overly permissive - it allows ANY s3:*
     // action, but only against objects in home/David/
     "Action": ["s3:*"],
     "Resource": ["arn:aws:s3:::my-company/home/David/*"]
   }
 ]
}