如何使用get_federation_token限制对S3资源的访问？

I'm trying to use federation tokens to manage access to folders in an S3 bucket. However, in my sample code the user gets access to the entire bucket. The following spec succeeds, but I would expect it to fail based on this document: I'm trying to use federation tokens to manage a