aws/iam: Allow server to read s3://nextstrain-inventories/resources.j…

…son.gz

Based on changes @jameshadfield made in the AWS Console, but stripped
down to just the single object necessary by the current consuming code.

(Cherry-picked from d6198a4 so I can
temporarily deploy changes to testing for my branch without reverting
the changes in this commit.  I'd prefer to set up a separate
branch-specific Terraform config/environment, but that's not a workable
solution for this issue until IAM _users_ are also integrated into our
Terraform config.)

aws/iam/policy/NextstrainDotOrgServerInstance-testing.tftpl.json

@@ -55,6 +55,16 @@
       "Resource": [
         "arn:aws:cognito-idp:us-east-1:827581582529:userpool/${COGNITO_USER_POOL_ID}"
       ]
+    },
+    {
+      "Sid": "GetResourcesIndex",
+      "Effect": "Allow",
+      "Action": [
+        "s3:GetObject"
+      ],
+      "Resource": [
+        "arn:aws:s3:::nextstrain-inventories/resources.json.gz"
+      ]
     }
   ]
 }

aws/iam/policy/NextstrainDotOrgServerInstance.tftpl.json

@@ -44,6 +44,16 @@
       "Resource": [
         "arn:aws:cognito-idp:us-east-1:827581582529:userpool/${COGNITO_USER_POOL_ID}"
       ]
+    },
+    {
+      "Sid": "GetResourcesIndex",
+      "Effect": "Allow",
+      "Action": [
+        "s3:GetObject"
+      ],
+      "Resource": [
+        "arn:aws:s3:::nextstrain-inventories/resources.json.gz"
+      ]
     }
   ]
 }