Add SSO user to condition for S3 bucket policy

I am using SSO to login to root, prod and non prod account. I have s3 buckets in prod account where I want only few users to have full access. I tried to add in-policy in the permission set , but it is not working.

I tried using assumed role that is in prod account which is created by SSO .

what I am doing is below, but I get error that , put access is not granted. can you please let me know what is wrong here?

{
      "Sid": "S3FullAccess",
      "Action": "s3:*",
      "Effect": "Allow",
      "Resource": [
            "arn:aws:s3:::<bucket-name>",
            "arn:aws:s3:::<bucket-name>/*"
            ],
      "Condition": {
        "ArnEquals": {
          "aws:PrincipalArn": [
              "arn:aws:iam::<account-id>:role/aws-reserved/sso.amazonaws.com/eu-central-1/<sso-role>",
              "arn:aws:sts::<account-id>:assumed-role/<sso-role>/<sso-user>"
          ]
        }
      }
    }

in addition to this I tried the solution in this link but it also didn't help me s3 bucket policy for sso user