How can I set the bucket policy to allow/deny actions for a particular Spaces API user?

I need to set a bucket policy so that only one of my API users (defined in Spaces access keys and properly authenticated via key and secret) can perform s3:PutObject and s3:deleteObject.

What do I need to specify as Principal in the policy below?

{
            "Sid": "AllowPrivatePutAndDelete",
            "Effect": "Allow",
            "Principal": {...},
            "Action": [
                "s3:PutObject",
                "s3:DeleteObject"
            ],
            "Resource": [
                "arn:aws:s3:::<bucket>/*"
            ]
        }

Thanks!