在 S3 存储桶策略中，将 SSO 用户添加到条件中。这可以确保只有经过身份验证的 SSO 用户才能访问 S3 存储桶。

以下是一个示例，用于将 SSO 用户添加到 S3 存储桶策略的条件中：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowSSOUsersAccess",
            "Effect": "Allow",
            "Principal": "*",
            "Action": [
                "s3:ListBucket",
                "s3:GetBucketLocation"
            ],
            "Resource": [
                "arn:aws:s3:::example-bucket"
            ],
            "Condition": {
                "StringLike": {
                    "aws:PrincipalArn": [
                        "arn:aws:iam::*:saml-provider/SSO-provider",
                        "arn:aws:iam::*:role/sso_role_name"
                    ]
                }
            }
        },
        {
            "Sid": "AllowSSOUsersObjectAccess",
            "Effect": "Allow",
            "Principal": "*",
            "Action": [
                "s3:GetObject",
                "s3:PutObject"
            ],
            "Resource": [
                "arn:aws:s3:::example-bucket/*"
            ],
            "Condition": {
                "StringLike": {
                    "aws:PrincipalArn": [
                        "arn:aws:iam::*:saml-provider/SSO-provider",
                        "arn:aws:iam::*:role/sso_role_name"
                    ]
                }
            }
        }
    ]
}

上述示例中，“Condition”部分包含了仅限 SSO 用户访问 S3 存储桶的条件，如下所示：

"Condition": {
    "StringLike": {
        "aws:PrincipalArn": [
            "arn:aws:iam::*:saml-provider/SSO-provider",
            "arn:aws:iam::*:role/sso_role_name"