If you use a policy that restricts access to a folder into the bucket, the plugin would return access denied because do not use the prefix to check the bucket access.