How to restrict S3 bucket access only to a kinesis firehose delivery stream using “NotPrincipal” in bucket policy?

Question

I am sending data from an AWS IoT core to a Kinesis data stream. The data stream finally dumps device data to an S3 bucket named dtmu-mock-bucket-1. Kinesis deliver