File upload functionality for own interiors (#39)

cloudformation/Makefile

@@ -31,12 +31,16 @@ ifeq ($(STACK_ENVIRONMENT_NAME),production)
 	DB_SECURITY_GROUP_ID=$(DB_SECURITY_GROUP_ID_PRODUCTION)
 	CPU_SIZE=1024
 	MEMORY_SIZE=2GB
+	IMAGES_BUCKET=photowall-images
+	UPLOAD_BUCKET=photowall-inquiries
 else
 	SUBDOMAIN=$(STACK_NAME)-$(STACK_ENVIRONMENT_NAME)
 	GITHUB_BRANCH=$(STACK_ENVIRONMENT_NAME)
 	DB_SECURITY_GROUP_ID=$(DB_SECURITY_GROUP_ID_STAGING)
 	CPU_SIZE=512
 	MEMORY_SIZE=1GB
+	IMAGES_BUCKET=photowall-images-dev
+	UPLOAD_BUCKET=photowall-inquiries-dev
 endif
 
 check-create-initial-ecr-image:
@@ -99,7 +103,9 @@ create-stack: check-create-variables-set check-create-initial-ecr-image
 								 ParameterKey="GitHubBranch",ParameterValue="$(GITHUB_BRANCH)" \
 								 ParameterKey="GitHubToken",ParameterValue="$(GITHUB_TOKEN)" \
 								 ParameterKey="CpuSize",ParameterValue="$(CPU_SIZE)" \
-								 ParameterKey="MemorySize",ParameterValue="$(MEMORY_SIZE)"
+								 ParameterKey="MemorySize",ParameterValue="$(MEMORY_SIZE)" \
+								 ParameterKey="ImagesBucket",ParameterValue="$(IMAGES_BUCKET)" \
+								 ParameterKey="UploadBucket",ParameterValue="$(UPLOAD_BUCKET)"
 
 update-stack: set-repository-lifecycle-policy
 	$(call checkdef,STACK_NAME)
@@ -117,4 +123,6 @@ update-stack: set-repository-lifecycle-policy
 								 ParameterKey="GitHubBranch",UsePreviousValue=true \
 								 ParameterKey="GitHubToken",UsePreviousValue=true \
 								 ParameterKey="CpuSize",ParameterValue="$(CPU_SIZE)" \
-								 ParameterKey="MemorySize",ParameterValue="$(MEMORY_SIZE)"
+								 ParameterKey="MemorySize",ParameterValue="$(MEMORY_SIZE)" \
+								 ParameterKey="ImagesBucket",ParameterValue="$(IMAGES_BUCKET)" \
+								 ParameterKey="UploadBucket",ParameterValue="$(UPLOAD_BUCKET)"

cloudformation/ecs-service.yaml

@@ -87,6 +87,12 @@ Parameters:
   GitHubUser:
     Type: String
 
+  # Buckets
+  ImagesBucket:
+    Type: String
+  UploadBucket:
+    Type: String
+
 Resources:
   Cluster:
     Type: AWS::ECS::Cluster
@@ -149,6 +155,32 @@ Resources:
       ManagedPolicyArns:
         - 'arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy'
         - arn:aws:iam::aws:policy/AmazonSSMReadOnlyAccess
+
+  TaskRoleAccessPolicy:
+    Type: 'AWS::IAM::ManagedPolicy'
+    Properties:
+      Description: Create access policies for the container task
+      Path: /
+      PolicyDocument:
+        Version: '2012-10-17'
+        Statement:
+          - Effect: Allow
+            Action:
+              - s3:*
+            Resource: !Sub arn:aws:s3:::${ImagesBucket}/*
+          - Effect: Allow
+            Action:
+              - s3:*
+            Resource: !Sub arn:aws:s3:::${ImagesBucket}
+          - Effect: Allow
+            Action:
+              - s3:*
+            Resource: !Sub arn:aws:s3:::${UploadBucket}/*
+          - Effect: Allow
+            Action:
+              - s3:*
+            Resource: !Sub arn:aws:s3:::${UploadBucket}
+
   # A role for the containers
   TaskRole:
     Type: AWS::IAM::Role
@@ -160,6 +192,8 @@ Resources:
             Principal:
               Service: ecs-tasks.amazonaws.com
             Action: 'sts:AssumeRole'
+      ManagedPolicyArns:
+        - !Ref TaskRoleAccessPolicy
 
   # A role needed for auto scaling
   AutoScalingRole: