S3 bucket restriction. Enable get/put on one bucket, but deny explicitly everything else

bucket-exclusive.json

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowAllBasics",
            "Effect": "Allow",
            "Action": [
                "s3:ListAllMyBuckets",
                "s3:HeadBucket",
                "s3:ListObjects"
            ],
            "Resource": "arn:aws:s3:::*"
        },
        {
            "Sid": "AllowListBuckets",
            "Effect": "Allow",
            "Action": [
                "s3:ListBuckets",
                "s3:GetBucketLocation"
            ],
            "Resource": "arn:aws:s3:::BUCKET_NAME"
        },
        {
            "Sid": "AllowGetPutObjects",
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:PutObject"
            ],
            "Resource": "arn:aws:s3:::BUCKET_NAME/*"
        },
        {
            "Sid": "DenyOtherBuckets",
            "Effect": "Deny",
            "Action": [
                "s3:Put*",
                "s3:Delete*"
            ],
            "NotResource": "arn:aws:s3:::BUCKET_NAME/*"
        }
    ]
}