aws/iam: Allow server to read s3://nextstrain-inventories/resources.j…

…son.gz Based on changes @jameshadfield made in the AWS Console, but stripped down to just the single object necessary by the current consuming code.
nextstrain · Oct 19, 2023 · 354a458 · 354a458
1 parent b1de8ee
commit 354a458
Show file tree

Hide file tree

Showing 2 changed files with 20 additions and 0 deletions.
diff --git a/aws/iam/policy/NextstrainDotOrgServerInstance-testing.tftpl.json b/aws/iam/policy/NextstrainDotOrgServerInstance-testing.tftpl.json
@@ -55,6 +55,16 @@
       "Resource": [
         "arn:aws:cognito-idp:us-east-1:827581582529:userpool/${COGNITO_USER_POOL_ID}"
       ]
+    },
+    {
+      "Sid": "GetResourcesIndex",
+      "Effect": "Allow",
+      "Action": [
+        "s3:GetObject"
+      ],
+      "Resource": [
+        "arn:aws:s3:::nextstrain-inventories/resources.json.gz"
+      ]
     }
   ]
 }
diff --git a/aws/iam/policy/NextstrainDotOrgServerInstance.tftpl.json b/aws/iam/policy/NextstrainDotOrgServerInstance.tftpl.json
@@ -44,6 +44,16 @@
       "Resource": [
         "arn:aws:cognito-idp:us-east-1:827581582529:userpool/${COGNITO_USER_POOL_ID}"
       ]
+    },
+    {
+      "Sid": "GetResourcesIndex",
+      "Effect": "Allow",
+      "Action": [
+        "s3:GetObject"
+      ],
+      "Resource": [
+        "arn:aws:s3:::nextstrain-inventories/resources.json.gz"
+      ]
     }
   ]
 }