S3 Bucket Policy to Allow access to specific AWS services and users and restrict other all

Question

I have a bucket policy which is restricting other users to access. But I want, For aws services it should be accessible like EMR etc. I found same question is asked here: S3 Bucket Policy to Allow access to specific users and restrict all . But I want to add services also. Like aws services can access that bucket but not users.

This is my bucket policy:

  AUser:
    Description: Name of the AUser
    Type: String             
  BUser:
    Description: Name of the BUser
    Type: String
  MetadataBucket:
    Description: Name of the Metadata Bucket
    Type: String                    
Resources:    
  MetadataBucketSecurity:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: 
        Ref: MetadataBucket 
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - 
            Effect: Deny
            NotPrincipal:
              AWS:
              - !Sub 'arn:aws:iam::${AWS::AccountId}:user/${AUser}'
              - !Sub 'arn:aws:iam::${AWS::AccountId}:user/${BUser}'
            Action: 
            - 's3:ListBucket'
            - 's3:RestoreObject'
            - 's3:ReplicateObject'
            - 's3:PutObject'
            - 's3:PutBucketNotification'
            - 's3:PutBucketLogging'
            - 's3:PutObjectTagging'
            - 's3:DeleteObject'
            - 's3:GetObjectAcl'
            - 's3:GetObject'
            - 's3:GetBucketLogging'
            - 's3:GetBucketAcl'
            - 's3:ListBucketByTags'
            - 's3:GetObjectVersionAcl'
            - 's3:GetBucketPolicy'
            Resource:
              - !Sub 'arn:aws:s3:::${Bucket}'
              - !Sub 'arn:aws:s3:::${Bucket}/*'

I tried to add this services directly, but it did not worked.

  AUser:
    Description: Name of the AUser
    Type: String             
  BUser:
    Description: Name of the BUser
    Type: String                    
  MetadataBucket:
    Description: Name of the Metadata Bucket
    Type: String 
Resources:    
  MetadataBucketSecurity:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: 
        Ref: MetadataBucket 
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - 
            Effect: Deny
            NotPrincipal:
              AWS:
              - !Sub 'arn:aws:iam::${AWS::AccountId}:user/${AUser}'
              - !Sub 'arn:aws:iam::${AWS::AccountId}:user/${BUser}'
              Service:
              - 'elasticmapreduce.amazonaws.com'
              - 'ec2.amazonaws.com'
            Action: 
            - 's3:ListBucket'
            - 's3:RestoreObject'
            - 's3:ReplicateObject'
            - 's3:PutObject'
            - 's3:PutBucketNotification'
            - 's3:PutBucketLogging'
            - 's3:PutObjectTagging'
            - 's3:DeleteObject'
            - 's3:GetObjectAcl'
            - 's3:GetObject'
            - 's3:GetBucketLogging'
            - 's3:GetBucketAcl'
            - 's3:ListBucketByTags'
            - 's3:GetObjectVersionAcl'
            - 's3:GetBucketPolicy'
            Resource:
              - !Sub 'arn:aws:s3:::${Bucket}'
              - !Sub 'arn:aws:s3:::${Bucket}/*'

After that I tried this also:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Deny",
            "NotPrincipal": {
                "AWS": [
                    "arn:aws:iam::ano:root",
                    "arn:aws:iam::ano:user/AUser",
                ]
            },
            "Action": [
                "s3:ListBucket",
                "s3:RestoreObject",
                "s3:ReplicateObject",
                "s3:PutBucketNotification",
                "s3:PutBucketLogging",
                "s3:PutObjectTagging",
                "s3:DeleteObject",
                "s3:GetObjectAcl",
                "s3:GetBucketLogging",
                "s3:GetBucketAcl",
                "s3:ListBucketByTags",
                "s3:GetObjectVersionAcl",
                "s3:GetBucketPolicy"
            ],
            "Resource": [
                "arn:aws:s3:::Bucket1",
                "arn:aws:s3:::Bucket1/*"
            ]
        },
        {
            "Sid": "InventoryAndAnalyticsExamplePolicy",
            "Effect": "Allow",
            "Principal": {
                "Service": [
                    "elasticmapreduce.amazonaws.com",
                    "ec2.amazonaws.com",
                    "s3.amazonaws.com"
                ]
            },
            "Action": [
                "s3:GetObject",
                "s3:PutObject"
            ],
            "Resource": [
                "arn:aws:s3:::Bucket1",
                "arn:aws:s3:::Bucket1/*"
            ]
        }
    ]
}

But still it is not working

Is there any way where I can give access of S3 buckets to particular users and restrict others and with that AWS services should be access to that bucket?