Cloudformation - Check if S3 folder exists and apply policy to the specific folder

Question

Hello:
I am writing a cloudformation template to create an S3 bucket. This S3 bucket can have multiple folders created programmatically.  So I want to apply a bucket policy that checks if a specific folder exists and allow only specific file types. 
For ex, if there is an S3 bucket called 'my-test-s3' with nested folders /folder1/folder2/pdf, I want to check if the folder 'pdf' exists. If it does, only allow for file types of *.pdf in this folder. How do I write the bucket policy for this using cloudformation template? I tried this below. However, this prevents creation of any folders inside my 'S3Bucket'.  I am looking for some guidance on this.

Sid: Stmt1631632005699
            Effect: Deny
            Principal: 
              AWS: !Sub 'arn:aws:iam::${AWS::AccountId}:root/'
            Action:
               - 's3:PutObject'
            NotResource:
               - !Sub arn:aws:s3:::${S3Bucket}/*/*/pdf/*.pdf

Accepted Answer

Something like this:

```
{
  "Id": "Policy1649706507409",
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Stmt1649706435908",
      "Action": [
        "s3:PutObject"
      ],
      "Effect": "Allow",
      "Resource": "arn:aws:s3:::mybucket/*.pdf",
      "Condition": {
        "StringLike": {
          "s3:prefix": "pdf/"
        }
      },
      "Principal": "*"
    },
    {
      "Sid": "Stmt1649706506153",
      "Action": [
        "s3:PutObject"
      ],
      "Effect": "Deny",
      "NotResource": "arn:aws:s3:::mybucket/*.pdf",
      "Condition": {
        "StringLike": {
          "s3:prefix": "pdf/"
        }
      },
      "Principal": "*"
    }
  ]
}
```

Cloudformation - Check if S3 folder exists and apply policy to the specific folder

Relevant questions

Cloudtrail S3 bucket objects

S3 Notification event name through CloudFormation

bulk move files from root of an S3 bucket to a folder (but not include other folders)

Cloudformation - Check if S3 folder exists and apply policy to the specific folder

S3 Bucket List reveals top-level object names

Not Able To Create a New Bucket - Policy Permissions Appear Correct

S3 bucket permissions to run CloudFormation from different accounts and create Lambda Funtions.

File Gateway (SMB) and Folder level KMS (CMK) in bucket

Can AWS CloudFormation template access s3 from any region other than its current region?

Concurrent writes to the same folder on an S3 bucket using the JavaScript SDK v2