Policy elements: Principal and NotPrincipal

• Do not use the Principal element in policies that you attach to IAM users, IAM groups or IAM role. In those cases, the principal is implicitly the user that the policy is attached to (for IAM users) or the user who assumes the role (for role access policies). When the policy is attached to an IAM group, the principal is the IAM user in that group who is making the request.

• Use the NotPrincipal element to specify the IAM user, federated user, IAM role, AWS account, AWS service, or other principal that is not allowed or denied access to a resource. The NotPrincipal element enables you to specify an exception to a list of principals. Use this element to deny access to all principals except the one named in the NotPrincipal element.

• You cannot use the NotPrincipal element in an IAM identity-based policy. You can use it in the trust policies for IAM roles and in resource-based policies.

• This example by itself does not grant access to Bob, it only omits Bob from the list of principals that are explicitly denied. To allow Bob access to the resource, another policy statement must explicitly allow access using "Effect": "Allow":

  {
      "Version": "2012-10-17",
      "Statement": [{
          "Effect": "Deny",
          "NotPrincipal": {"AWS": [
              "arn:aws:iam::444455556666:user/Bob",
              "arn:aws:iam::444455556666:root"
          ]},
          "Action": "s3:*",
          "Resource": [
              "arn:aws:s3:::BUCKETNAME",
              "arn:aws:s3:::BUCKETNAME/*"
          ]
      }]
  }