亚马逊认知+ S3政策 - 不工作身份子变量

Question

我正在使用Amazon cognito和S3。我希望实现每个用户在S3（教程示例）中都有“自己的”目录。所以我设置了以下策略（遵循此示例https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_examples_s3_cognito-bucket.html）：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::sg-cognito-s3-bucket-test"
            ],
            "Condition": {
                "StringLike": {
                    "s3:prefix": [
                        "users"
                    ]
                }
            }
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:PutObject",
                "s3:DeleteObject"
            ],
            "Resource": [
                "arn:aws:s3:::sg-cognito-s3-bucket-test/users/${cognito-identity.amazonaws.com:sub}",
                "arn:aws:s3:::sg-cognito-s3-bucket-test/users/${cognito-identity.amazonaws.com:sub}/*"
            ]
        }
    ]
}

问题是我上传了DENDIED并上传。

但是当我像这样更新第二条规则时：

"Resource": [
                    "arn:aws:s3:::sg-cognito-s3-bucket-test/users",
                    "arn:aws:s3:::sg-cognito-s3-bucket-test/users/*"
                ]

我可以上传文件。

我如何做清单和上传？

s3.listObjects({
    Bucket: AppComponent.S3_BUCKET
  }, function(err, data){
  });
s3.putObject({
    Bucket: AppComponent.S3_BUCKET,
    Key: 'users/' + sub + '/' + 'test.txt',
    Body: 'hello, i am: ' + sub
  },function (error, resp) {    
  });

非常感谢！