fix: Update IAM policy with specific S3 permissions for SAM deployment

- Add specific S3 permissions for SAM deployment bucket
- Include s3:GetObject, s3:PutObject, s3:DeleteObject, s3:ListBucket
- Add s3:GetBucketLocation, s3:GetObjectVersion, s3:PutObjectAcl
- Allow s3:CreateBucket, s3:DeleteBucket, s3:ListAllMyBuckets for bucket management
- Target specific S3 bucket: cn-seba-aws-sam-cli-managed-default-samclisourcebucket

Author: Hirose-Sebastian-Taikai

create_role.ps1

@@ -1111,12 +1111,36 @@ $POLICY_DOCUMENT = @"
             "Effect": "Allow",
             "Action": [
                 "cloudformation:*",
-                "s3:*",
                 "lambda:*",
                 "iam:*",
                 "logs:*"
             ],
             "Resource": "*"
+        },
+        {
+            "Effect": "Allow",
+            "Action": [
+                "s3:GetObject",
+                "s3:PutObject",
+                "s3:DeleteObject",
+                "s3:ListBucket",
+                "s3:GetBucketLocation",
+                "s3:GetObjectVersion",
+                "s3:PutObjectAcl"
+            ],
+            "Resource": [
+                "arn:aws:s3:::cn-seba-aws-sam-cli-managed-default-samclisourcebucket",
+                "arn:aws:s3:::cn-seba-aws-sam-cli-managed-default-samclisourcebucket/*"
+            ]
+        },
+        {
+            "Effect": "Allow",
+            "Action": [
+                "s3:CreateBucket",
+                "s3:DeleteBucket",
+                "s3:ListAllMyBuckets"
+            ],
+            "Resource": "*"
         }
     ]
 }

create_role.sh

@@ -1094,12 +1094,36 @@ POLICY_DOCUMENT=$(cat <<EOF
             "Effect": "Allow",
             "Action": [
                 "cloudformation:*",
-                "s3:*",
                 "lambda:*",
                 "iam:*",
                 "logs:*"
             ],
             "Resource": "*"
+        },
+        {
+            "Effect": "Allow",
+            "Action": [
+                "s3:GetObject",
+                "s3:PutObject",
+                "s3:DeleteObject",
+                "s3:ListBucket",
+                "s3:GetBucketLocation",
+                "s3:GetObjectVersion",
+                "s3:PutObjectAcl"
+            ],
+            "Resource": [
+                "arn:aws:s3:::cn-seba-aws-sam-cli-managed-default-samclisourcebucket",
+                "arn:aws:s3:::cn-seba-aws-sam-cli-managed-default-samclisourcebucket/*"
+            ]
+        },
+        {
+            "Effect": "Allow",
+            "Action": [
+                "s3:CreateBucket",
+                "s3:DeleteBucket",
+                "s3:ListAllMyBuckets"
+            ],
+            "Resource": "*"
         }
     ]
 }