The user should upload/see the objects, but can not download/get them from S3 bucket

Yes, it is possible to implement a structure where an SFTP user can upload data but cannot download it, while still being able to see the objects in the S3 bucket. This can be achieved through a carefully crafted IAM policy.

The challenge you're facing is that the s3:GetObject permission is indeed required for certain operations, including listing and traversing folders, even if you don't want the user to be able to download the actual files. However, we can use a policy condition to allow GetObject only for objects that end with a slash ("/"), which represents folders in S3.

Here's how you can modify your IAM policy to achieve this:

1. Allow listing of the bucket
2. Allow putting objects (for uploads)
3. Allow getting objects, but only for "folders" (objects ending with "/")
4. Explicitly deny getting objects that are not folders

Here's an example policy that implements this:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowListing",
            "Effect": "Allow",
            "Action": "s3:ListBucket",
            "Resource": "arn:aws:s3:::your-bucket-name"
        },
        {
            "Sid": "AllowUpload",
            "Effect": "Allow",
            "Action": "s3:PutObject",
            "Resource": "arn:aws:s3:::your-bucket-name/*"
        },
        {
            "Sid": "AllowFolderOperations",
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:GetObjectVersion"
            ],
            "Resource": "arn:aws:s3:::your-bucket-name/*"
        },
        {
            "Sid": "DenyIfNotFolder",
            "Effect": "Deny",
            "Action": [
                "s3:GetObject",
                "s3:GetObjectVersion"
            ],
            "NotResource": [
                "arn:aws:s3:::your-bucket-name/*/",
                "arn:aws:s3:::your-bucket-name/*.filepart"
            ]
        }
    ]
}

This policy allows the user to:

• List the contents of the bucket
• Upload files (PutObject)
• Perform GetObject operations on folders (objects ending with "/")
• Perform operations on partial uploads (objects ending with ".filepart")

At the same time, it explicitly denies GetObject operations on any objects that don't end with "/" or ".filepart", effectively preventing downloads of actual files.

Remember to replace "your-bucket-name" with the actual name of your S3 bucket.

This approach should allow your SFTP user to see the objects in the bucket and upload new files, but prevent them from downloading existing files. The user should be able to navigate through the folder structure without encountering "access denied" errors.

If you're still experiencing issues after implementing this policy, double-check that the IAM role is correctly attached to your SFTP user in AWS Transfer Family, and that there are no conflicting bucket policies or ACLs on your S3 bucket.
Sources
Configure storage to use with AWS Transfer Family servers - AWS Transfer Family
Implementing least privilege access in an AWS Transfer Family workflow | AWS Storage Blog