AWS S3 Allows reading of all objects except a specific folder

Question

1. How can I allow reading of all objects except a single folder and its contents? The rule below blocks me the whole bucket.. (can't read the bucket)

2. If this feature isn't possible, how can I allow reading on files at the root but deny on all subfolders?

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "ListBucket",
            "Effect": "Allow",
            "Action": "s3:ListBucket",
            "Resource": "arn:aws:s3:::my-bucket"
        },
        {
            "Sid": "ReadOnly",
            "Effect": "Allow",
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::my-bucket/*"
        },
        {
            "Sid": "DenyOneFolder",
            "Effect": "Deny",
            "Action": "s3:GetObject",
            "Resource": [
                "arn:aws:s3:::my-bucket/my-folder",
                "arn:aws:s3:::my-bucket/my-folder/*"
            ]
        }
    ]
}

My bucket strcture:

• my-bucket
  • my-folder
    • object3
  • object1
  • object2

Answer 1

You can add an explicit Deny in your bucket policy for Listing objects that matches the prefix my-folder.

Edit: This policy will work only if the list bucket request contains the prefix.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "ListBucket",
            "Effect": "Allow",
            "Action": "s3:ListBucket",
            "Resource": "arn:aws:s3:::my-bucket"
        },
        {
            "Sid": "ReadOnly",
            "Effect": "Allow",
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::my-bucket/*"
        },
        {
            "Sid": "DenyOneFolderRead",
            "Effect": "Deny",
            "Action": "s3:GetObject",
            "Resource": [
                "arn:aws:s3:::my-bucket/my-folder/*"
            ]
        },
        {
            "Sid": "DenyOneFolderList",
            "Effect": "Deny",
            "Action": "s3:ListBucket",
            "Resource": "arn:aws:s3:::my-bucket",
            "Condition" : {
                "StringEquals" : {
                    "s3:prefix": "my-folder" 
                }
            } 
        }
    ]
}