特定のS3の特定のディレクトリ以下だけ読み書き可能なIAMポリシー

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListBucketVersions",
                "s3:ListBucket"
            ],
            "Resource": "arn:aws:s3:::AWSDOC-EXAMPLE-BUCKET",
            "Condition": {
                "StringLike": {
                    "s3:prefix": "app/*"
                }
            }
        },
        {
            "Effect": "Allow",
            "Action": "s3:GetBucketVersioning",
            "Resource": "arn:aws:s3:::AWSDOC-EXAMPLE-BUCKET"
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:PutObject",
                "s3:GetObjectAcl",
                "s3:GetObject",
                "s3:DeleteObjectVersion",
                "s3:GetObjectVersionTagging",
                "s3:GetObjectVersionAcl",
                "s3:GetObjectTagging",
                "s3:DeleteObject",
                "s3:GetObjectVersion"
            ],
            "Resource": "arn:aws:s3:::AWSDOC-EXAMPLE-BUCKET/app/*"
        }
    ]
}