I ran into some issues trying to scope in this way. I still need to test but I think the way to restrict will be one policy for

    s3:ListBucket
    arn:aws:s3:::mapbox-node-binary

And another policy for

    s3:DeleteObject
    s3:GetObject
    s3:GetObjectAcl
    ...
    arn:aws:s3:::mapbox-node-binary/tilelive-s3/*