You create a policy [1] for each upload and sign it. The users browser has to provide the policy which can set the path (or prefix), limit file size etc.

[1]: http://docs.aws.amazon.com/AmazonS3/latest/API/sigv4-HTTPPOS...