I’m trying to configure an S3 bucket that the public can drop files into (but not read, delete or list) and that the root user can have full access to. I cant find how to code the policy to match both of those requirements at the same time.

I’ve tried the following policy, the public can indeed write but not read. However the root user cant see the list of objects in the AWS console I get the error “Insufficient permissions to list objects
After you or your AWS administrator has updated your permissions to allow the s3:ListBucket action, refresh the page”.
Changing the order of the “Statement” clauses doesn’t help.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::MY_ACCOUNT_ID:root"
            },
            "Action": [
                "s3:GetObject",
                "s3:DeleteObject",
                "s3:ListBucket",
                "s3:PutObject"
            ],
            "Resource": [
                "arn:aws:s3:::BUCKET_NAME_HERE",
                "arn:aws:s3:::BUCKET_NAME_HERE/*"
            ]
        },
        {
            "Effect": "Deny",
            "Principal": "*",
            "Action": "s3:*",
            "Resource": [
                "arn:aws:s3:::BUCKET_NAME_HERE",
                "arn:aws:s3:::BUCKET_NAME_HERE/*"
            ]
        },
        {
            "Effect": "Allow",
            "Principal": "*",
            "Action": "s3:PutObject",
            "Resource": [
                "arn:aws:s3:::BUCKET_NAME_HERE",
                "arn:aws:s3:::BUCKET_NAME_HERE/*"
            ]
        }
    ]
}