Amazon cognito Identity ID (sub) + S3 bucket name - amazon-s3

Question

I am currently working on a webApp to let authenticated users (by Cognito User Pool) to handle their own s3 bucket. In this way, I would like to use the following variable ${cognito-identity.amazonaws.com:sub} in order to dynamically name my s3 buckets.
This is what I am expecting about my s3 role linked to my authenticated users from my Cognito federated identities :
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"s3:*"
],
"Resource": [
"arn:aws:s3:::${cognito-identity.amazonaws.com:sub}/*"
]
}
]
}
The value of ${cognito-identity.amazonaws.com:sub} looks like "eu-west-2:xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxx", but I know S3 name cannot contain ":" special character...
Is there any workaround in order to dynamically name my s3 buckets based on each cognito Identity ID ?
Looking forward any tips/advices :)

Answer 1

As #Rasikh mentions in his comment, there are limits to the number of S3 buckets per account. 100 by default, although you can get that increased to a maximum of 1,000 by submitting a service limit request to AWS. However, the solution is not scalable to any number of users.
A more common pattern is to create just a single s3 bucket, and only give each authenticated user the permissions to access a certain prefix (path or folder) based on their cognito identity's sub property.
The following policy (taken from Example 2 of the Access Policy Examples) gives a cognito web identity s3:ListBucket permission, but only for their particular prefix, and the ability to get and put objects, but again only inside their prefix.
{
"Version": "2012-10-17",
"Statement": [
{
"Action": ["s3:ListBucket"],
"Effect": "Allow",
"Resource": ["arn:aws:s3:::mybucket"],
"Condition": {"StringLike": {"s3:prefix": ["${cognito-identity.amazonaws.com:sub}/*"]}}
},
{
"Action": [
"s3:GetObject",
"s3:PutObject"
],
"Effect": "Allow",
"Resource": ["arn:aws:s3:::mybucket/${cognito-identity.amazonaws.com:sub}/*"]
}
]
}
It's worth noting that this will only work for authenticated users, as unauthenticated users will get a different cognito identity, as thus a different sub, each time.