amazon web services - Only allow specific user access to s3 folder. make private to everyone else -

i have tried deny overall access, , give specific access provided user happens application. executing put , requests using aws service api.

i have tried following, since have deny on users, not let allowed user request though stated in policy.

ideally allow access specific group. tried using following , bucket policy wouldn't save stating 'invalid principal in policy - ' arn:aws:iam::222222222222:group/admin

i rather server private content on cloudfront , make s3 buckets private. option #2 http://docs.aws.amazon.com/amazoncloudfront/latest/developerguide/privatecontent.html

is there better way deny access except specified users?

{ "sid": "force deny access private folder", "effect": "deny", "principal": {   "aws": "*" }, "action": "s3:getobject", "resource": "arn:aws:s3:::bucket/apptest/*" 

},

{   "sid": "allow s3 uplaod , conversion using aws-sdk",   "effect": "allow",   "principal": {     "aws": "arn:aws:iam::111111111111:user/user_name"   },   "action": [     "s3:getobjectversiontorrent",     "s3:abortmultipartupload",     "s3:getobjectacl",     "s3:getobjecttorrent",     "s3:restoreobject",     "s3:getobjectversion",     "s3:deleteobject",     "s3:deleteobjectversion",     "s3:getobject",     "s3:putobjectacl",     "s3:putobjectversionacl",     "s3:putobject",     "s3:getobjectversionacl"   ],   "resource": "arn:aws:s3:::bucket/apptest/*"} 

my money answer question before monday on codementor.

stop using s3 policy , use iam instead.

http://blogs.aws.amazon.com/security/post/txpojby6fe360k/iam-policies-and-bucket-policies-and-acls-oh-my-controlling-access-to-s3-resourc

if not, i'll see monday!