Amazon S3 Folder Level Permissions

You can use IAM policies in conjunction with bucket policies to manage such access.

Each individual client would need their own IAM profile, and you would set up policies to limit object access to only those accounts.

Here is the AWS documentation:

http://docs.aws.amazon.com/AmazonS3/latest/dev/UsingIAMPolicies.html

I would particularly point out Example 1 in that document, which does exactly what you want.

Please refer to the following policy to restrict the user to upload or list objects only to specific folders. I have created a policy that allows me to list only the objects of folder1 and folder2, and also allows to put the object to folder1 and deny uploads to other folders of the buckets. The policy does as below: 1.List all the folders of bucket 2.List objects and folders of allowed folders 3.Uploads files only to allowed folders

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowUserToSeeBucketListInTheConsole",
            "Action": [
                "s3:ListAllMyBuckets",
                "s3:GetBucketLocation"
            ],
            "Effect": "Allow",
            "Resource": [
                "arn:aws:s3:::*"
            ]
        },
        {
            "Sid": "AllowListingOfFolder1And2",
            "Action": [
                "s3:*"
            ],
            "Effect": "Deny",
            "Resource": [
                "arn:aws:s3:::bucketname"
            ],
            "Condition": {
                "StringNotLike": {
                    "s3:prefix": [
                        "folder1/*",
                        "folder2/*"
                    ]
                },
                "StringLike": {
                    "s3:prefix": "*"
                }
            }
        },
        {
            "Sid": "Allowputobjecttofolder1only",
            "Effect": "Deny",
            "Action": "s3:PutObject",
            "NotResource": "arn:aws:s3:::bucketname/folder1/*"
        }
    ]
}