Trying to use S3 and IAM Identity Center together

Question

I setup an S3 bucket so another company could upload some data to it. They gave me a policy to copy and paste in to allow them to upload to my bucket. After several hours of debugging with no help from the absolutely useless AWS error messages we eventually figured out our regions didn't match (why they have to match when S3 buckets are globally unique I don't know...). I can see the objects in the web interface, so now I have the data! Right? RIGHT?

Nope, I cannot `aws cp` the data because it says I don't have permission. This seems strange. I created the bucket. It's MY bucket, and the docs say the default is to allow access from your own account. How can I not have permission? I reach out to the other company and they tell me it's because the presence of their policy (the one I copy and pasted) prevents the default that gives me access from activating. If that's true, I could get access by just deleting the policy. However I may need more data from them in the future, so I'd like to add a new statement allowing me to download the data instead.

I'm using IAM Identity Center, so to follow best practice I figure I need to create a user that only has permission to read buckets and not write to them. So I create a user with the ReadOnly permission set. So far so good. Then I try to add a statement to the bucket, with that new user as principal... doesn't work. Nothing I've tried is accepted, I just keep getting the unhelpful "Invalid Principal" message. The [docs](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_principal.html) say you should be able to write `"arn:aws:iam::AWS-account-ID:user/user-name-1"` with your account ID and IAM Identity Center username substituted in. But that doesn't work, I just get the "Invalid Principal" error message. I've also tried using the User-ID for that user in the IAM Identity Center, and the "Federated user" name that shows up in the upper right corner menu when logged into the console as the new user. Using "arn:aws:iam::AWS-account-ID:root" with the same account ID works, so I know the account ID part is correct.

Answer

IAM Identity Center users do not contain an ARN (IAM ARN is not a substitute). 
You can allow access to your user to the S3 Bucket would be to use the Identity Center User information (User ID and Username) as a Condition in the S3 Bucket policy.

Example:
```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "UserID",
            "Effect": "Allow",
            "Principal": "*",
            "Action": [ "s3:*"],
            "Resource": "arn:aws:s3:::mybucket/*",
            "Condition": {
                "StringLike": {
                    "aws:userId": "SSOUserID:SSOUserName"
                }
            }
        }
    ]
}
```

Trying to use S3 and IAM Identity Center together

Relevant content