S3 Buckets, IAM, Cloudfront

Question

I followed @nystudio107 post here about setting up CraftCMS with Amazon S3 and Cloudfront and it works great except I can only upload if I have all public access enabled on the S3 bucket? The article specifically suggests disabling public access.

I suspect it's because I am trying to use the same IAM User, Group and policy across multiple buckets. This makes sense to us as we have a 'bucket' per client and would prefer not to create new policies, groups and users for every client.

I must admit I guessed at the possible code for 'global' buckets by inserting a 'wildcard' where there should be bucket names and it DOES seem to work for accessing assets across multiple buckets... just no luck with uploads?

Sample code from the policy JSON:

{
"Version": "2012-10-17",
"Statement": [
    {
        "Effect": "Allow",
        "Action": [
            "s3:ListAllMyBuckets"
        ],
        "Resource": "*"
    },
    {
        "Effect": "Allow",
        "Action": [
            "s3:GetBucketLocation",
            "s3:ListBucket",
            "s3:PutObject",
            "s3:GetObject",
            "s3:DeleteObject",
            "s3:GetObjectAcl",
            "s3:PutObjectAcl"
        ],
        "Resource": [
            "arn:aws:s3:::*/*"
        ]
    },
    {
        "Effect": "Allow",
        "Action": [
            "s3:GetBucketLocation",
            "s3:ListBucket"
        ],
        "Resource": [
            "arn:aws:s3:::*"
        ]
    }
]

}

Any advice/corrections/horrified expressions very welcome.

Many thanks

Martin