def make_policy(bucket_name, prefix, allow_get_location=False):
bucket_arn = "<STR_LIT>" + bucket_name<EOL>prefix_arn = "<STR_LIT>".format(bucket_name, prefix)<EOL>structure = {<EOL>"<STR_LIT>": "<STR_LIT>",<EOL>"<STR_LIT>": [<EOL>{<EOL>"<STR_LIT>": ["<STR_LIT>"],<EOL>"<STR_LIT>": "<STR_LIT>",<EOL>"<STR_LIT>": [bucket_arn],<EOL>"<STR_LIT>": {"<STR_LIT>": {"<STR_LIT>": [prefix + '<STR_LIT>']}},<EOL>},<EOL>{<EOL>"<STR_LIT>": "<STR_LIT>",<EOL>"<STR_LIT>": ["<STR_LIT>", "<STR_LIT>"],<EOL>"<STR_LIT>": [prefix_arn]<EOL>}]}<EOL>if allow_get_location:<EOL><INDENT>structure["<STR_LIT>"].append(<EOL>{"<STR_LIT>": ["<STR_LIT>"],<EOL>"<STR_LIT>": "<STR_LIT>",<EOL>"<STR_LIT>": [bucket_arn]})<EOL><DEDENT>return json.dumps(structure, indent=<NUM_LIT:2>)<EOL>
Produces a S3 IAM text for selective access of data.

    Only a prefix can be listed, gotten, or written to when a
    credential is subject to this policy text.