Thanks @Gert

I was having a permissions problem on upload - something to do with the scope down policy. I found it easier to limit the user access to a single folder with LOGICAL mappings as mentioned in the AWS docs

HomeDirectoryType: LOGICAL

HomeDirectoryMappings:

- Entry: '/'

Target: '/${BUCKET}/user'

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-transfer-user.html#cfn-transfer-user-homedirectorymappings