The link indeed is very helpful. It shows how to configure policies so that user can use console to upload/download objects from S3 to his own directory. Basically two more blocks are needed (in addition to two blocks listed in this question): Block 1: Allow required Amazon S3 console permissions Block 2: Allow listing objects in root and home folders

that ink is super helpful, many config are missing from it, hence B

I thought this link was super helpful. Here's a quote: "The ListAllMyBuckets action grants David permission to list all the buckets in the AWS account, which is required for navigating to buckets in the Amazon S3 console (and as an aside, you currently can’t selectively filter out certain buckets, so users must have permission to list all buckets for console access). The console also does a GetBucketLocation call when users initially navigate to the Amazon S3 console, which is why David also requires permission for that action. Without these two actions, David will get an access denied error in the console."

But if they type the right URL they get in. I don't see why it would not work. The question is not whether the user can navigate down to the right path. I think it's TRUE

It still gives permission only to "my-company/home/${aws:username}/*" , Permission to list all buckets is necessary to navigate to this folder

The issue here is not with the action, but with which resource is applied. In our case, it's applied to the folder's content, not the folder itself.