我使用的是AWS SDK为Android旁边Cognito（通过登录亚马逊）来验证用户身份，以我的AWS资源。我什么的尝试的做的是建立一个S3桶像这样：

I am using the AWS SDK for Android alongside Cognito to authenticate users (via Login With Amazon) to my AWS resources. What I am attempting to do is to setup an S3 bucket like so:

./my-bucket
  ├── first_user@email.com
  └── second_user@email.com

因此​​，我斗斗将根据用户的电子邮件地址有文件夹。

So, the my-bucket bucket will have folders based on the user's e-mail address.

我的第一个尝试设置的政策是这样：

My first stab to setup the policy was as such:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:ListBucket"],
      "Resource": ["arn:aws:s3:::my-bucket"]
    },
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:PutObject",
        "s3:DeleteObject"
      ],
      "Resource": [
        "arn:aws:s3:::my-bucket/${www.amazon.com:user_id}",
        "arn:aws:s3:::my-bucket/${www.amazon.com:user_id}/*"
      ]
    }
  ]
}

作为测试，我想下载一个文件夹，像这样一个用户：

As a test, I am trying to download a folder for a user like so:

final Map logins = new HashMap();
logins.put("www.amazon.com", token);
credentialsProvider.withLogins(logins);

final TransferManager transferManager = new TransferManager(credentialsProvider);
MultipleFileDownload download = transferManager.downloadDirectory("my-bucket", "first_user@email.com", new File("/sdcard/Download"));

然而，当我运行此我得到一个禁止例外。如果我修改了策略，明确引用 first_user@email.com ，而不是 $ {www.amazon.com:user_id}它工作正常。