{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "MountOnlyThisSession",
      "Effect": "Allow",
      "Action": ["s3files:ClientMount", "s3files:ClientWrite"],
      "Resource": "arn:aws:s3files:<AWS_REGION>:<ACCOUNT_ID>:file-system/<S3_FILES_FS_ID>",
      "Condition": {
        "StringEquals": {
          "s3files:AccessPointArn": "arn:aws:s3files:<AWS_REGION>:<ACCOUNT_ID>:file-system/<S3_FILES_FS_ID>/access-point/<SESSION_AP_ID>"
        }
      }
    },
    {
      "Sid": "ReadOnlyThisSessionObjects",
      "Effect": "Allow",
      "Action": ["s3:GetObject", "s3:GetObjectVersion"],
      "Resource": "arn:aws:s3:::<S3_BUCKET_NAME>/<S3_PREFIX>/<SESSION_PREFIX>/*",
      "Condition": {
        "StringEquals": { "aws:ResourceAccount": "<ACCOUNT_ID>" }
      }
    },
    {
      "Sid": "ListOnlyThisSessionPrefix",
      "Effect": "Allow",
      "Action": ["s3:ListBucket"],
      "Resource": "arn:aws:s3:::<S3_BUCKET_NAME>",
      "Condition": {
        "StringEquals": { "aws:ResourceAccount": "<ACCOUNT_ID>" },
        "StringLike": { "s3:prefix": "<S3_PREFIX>/<SESSION_PREFIX>/*" }
      }
    }
  ]
}