File upload functionality for own interiors (#39)

cloudformation/ecs-service.yaml

@@ -87,6 +87,12 @@ Parameters:
   GitHubUser:
     Type: String
 
+  # Buckets
+  ImagesBucket:
+    Type: String
+  UploadBucket:
+    Type: String
+
 Resources:
   Cluster:
     Type: AWS::ECS::Cluster
@@ -149,6 +155,32 @@ Resources:
       ManagedPolicyArns:
         - 'arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy'
         - arn:aws:iam::aws:policy/AmazonSSMReadOnlyAccess
+
+  TaskRoleAccessPolicy:
+    Type: 'AWS::IAM::ManagedPolicy'
+    Properties:
+      Description: Create access policies for the container task
+      Path: /
+      PolicyDocument:
+        Version: '2012-10-17'
+        Statement:
+          - Effect: Allow
+            Action:
+              - s3:*
+            Resource: !Sub arn:aws:s3:::${ImagesBucket}/*
+          - Effect: Allow
+            Action:
+              - s3:*
+            Resource: !Sub arn:aws:s3:::${ImagesBucket}
+          - Effect: Allow
+            Action:
+              - s3:*
+            Resource: !Sub arn:aws:s3:::${UploadBucket}/*
+          - Effect: Allow
+            Action:
+              - s3:*
+            Resource: !Sub arn:aws:s3:::${UploadBucket}
+
   # A role for the containers
   TaskRole:
     Type: AWS::IAM::Role
@@ -160,6 +192,8 @@ Resources:
             Principal:
               Service: ecs-tasks.amazonaws.com
             Action: 'sts:AssumeRole'
+      ManagedPolicyArns:
+        - !Ref TaskRoleAccessPolicy
 
   # A role needed for auto scaling
   AutoScalingRole: