Deny anonymous downloads in AWS S3

Depending on how many IAM users you have in the account, you can specify the accounts in both statements as follows (try one or two just as a test to see if it works). I've had issues in the past with getting arn:aws:iam::XXXXXXXXXXXX:root to actually cover all IAM accounts. You could also try just specifying the IAM users and remove the root entry.

{
    "Version": "2008-10-17",
    "Id": "Policy1424952346041",
    "Statement": [
        {
            "Sid": "Stmt1424958477350",
            "Effect": "Deny",
            "NotPrincipal": {
                "AWS": [
                        "arn:aws:iam::777777777777:root",
                        "arn:aws:iam::777777777777:user/user1", 
                        "arn:aws:iam::777777777777:user/user2" ]
            },
            "Action": "s3:*",
            "Resource": "arn:aws:s3:::test/*"
        },
        {
            "Sid": "Stmt1424958477351",
            "Effect": "Allow",
            "Principal": {
                "AWS": [
                        "arn:aws:iam::777777777777:root",
                        "arn:aws:iam::777777777777:user/user1",
                        "arn:aws:iam::777777777777:user/user2" ]
            },
            "Action": "s3:*",
            "Resource": "arn:aws:s3:::test/*"
        }
    ]
}