S3 Bucket策略，允许特定的AWS服务和用户访问，并限制其他所有访问。

下面是一个示例的S3 Bucket策略，允许特定的AWS服务和用户访问，并限制其他所有访问的代码示例：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowAWSServices",
            "Effect": "Allow",
            "Principal": {
                "Service": [
                    "s3.amazonaws.com",
                    "lambda.amazonaws.com"
                ]
            },
            "Action": "s3:*",
            "Resource": "arn:aws:s3:::your-bucket-name/*"
        },
        {
            "Sid": "AllowSpecificUser",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::123456789012:user/your-user-name"
            },
            "Action": "s3:*",
            "Resource": [
                "arn:aws:s3:::your-bucket-name",
                "arn:aws:s3:::your-bucket-name/*"
            ]
        },
        {
            "Sid": "DenyAllOtherAccess",
            "Effect": "Deny",
            "Principal": "*",
            "Action": "s3:*",
            "Resource": [
                "arn:aws:s3:::your-bucket-name",
                "arn:aws:s3:::your-bucket-name/*"
            ]
        }
    ]
}

上述示例中的策略包含三个Statement：

1. "AllowAWSServices" 允许特定的AWS服务（s3.amazonaws.com和lambda.amazonaws.com）访问S3 Bucket中的所有操作。

2. "AllowSpecificUser" 允许特定的用户（ARN为"arn:aws:iam::123456789012:user/your-user-name"）访问S3 Bucket中的所有操作。

3. "DenyAllOtherAccess" 拒绝所有其他实体（Principal为"*"）访问S3 Bucket中的所有操作。

请记得将示例中的"your-bucket-name"替换为您的实际S3 Bucket的名称，"123456789012"替换为您的实际AWS账户ID，"your-user-name"替换为您的实际用户名称。