amazon web services - Some "Condition"s disallowed in AWS S3 Bucket Policies? -

i'd define s3 bucket-level policy restricts access specific users (e.g. using cognito ids). why can't condition block following used in bucket policy?

{      "statement":[         {            "effect":"allow",          "principal": "*",          "condition": {               "stringequals":{                  "cognito-identity.amazonaws.com:aud":[                     "us-east-1:12345678-abcd-abcd-abcd-123456790ab",                   "us-east-1:98765432-dcba-dcba-dcba-123456790ab"                ]             }          },          "action":"s3:listbucket",          "resource":"arn:aws:s3:::my-bucket-name"       }    ] } 

when try, errror:
policy has invalid condition key - cognito-identity.amazonaws.com:aud

but block works fine (minus principal) in user-level policy. i'm trying understand rules are, don't have blindly attempt make changes , "see works".

to can refer ${cognito-identity.amazonaws.com:sub} bucket policy (e.g. inside of resource url); can't condition key (as in example above).

so: rules bucket policies different other policies? documented somewhere? i'd love pointer authoritative source here, because suspect may missing important documentation.

it seems can't add cognito-id based condition in bucket level policy can achieved adding policy identity pools auth role.

assume want every user in identity pool able read contents of bucked specific users write. can achived following policy.

{     "version": "2012-10-17",     "statement": [         {             "effect": "allow",             "action": [                 "s3:getobject"             ],             "resource": [                 "arn:aws:s3:::<bucketname>/*"             ]         },         {             "effect": "allow",             "action": [                 "s3:putobject"             ],             "resource": [                 "arn:aws:s3:::<bucketname>/*"             ],             "condition": {                 "stringequals": {                     "cognito-identity.amazonaws.com:sub": [                         "<cognito id1>",                         "<conito id2>"                     ]                 }             }         }     ] }