patch: Add S3 permissions to Lambda

Author: TotalDwarf03

src/main.py

@@ -568,6 +568,9 @@ def handler(event, context) -> str:  # type: ignore[no-untyped-def]
 
     logger.log_info("Initialised logging.")
 
+    # Log the configuration parameters
+    logger.log_info(config)
+
     # Get the environment variables
 
     org, app_client_id, aws_default_region, aws_secret_name = get_environment_variables()

terraform/service/data.tf

@@ -43,6 +43,23 @@ data "aws_iam_policy_document" "lambda_logging" {
   }
 }
 
+data "aws_iam_policy_document" "lambda_s3_policy" {
+  statement {
+    effect = "Allow"
+
+    actions = [
+      "s3:ListAllMyBuckets", # Allows listing all buckets in the account
+      "s3:GetObject",        # Allows reading objects in buckets
+      "s3:ListBucket"
+    ]
+
+    resources = [
+      "arn:aws:s3:::*",  # Allows access to all buckets
+      "arn:aws:s3:::*/*" # Allows access to all objects within all buckets
+    ]
+  }
+}
+
 data "aws_iam_policy_document" "lambda_secret_manager_policy" {
   statement {
     effect = "Allow"

terraform/service/main.tf

@@ -99,6 +99,17 @@ resource "aws_iam_role_policy_attachment" "lambda_logs" {
   policy_arn = aws_iam_policy.lambda_logging.arn
 }
 
+resource "aws_iam_policy" "lambda_s3_policy" {
+  name        = "${var.lambda_name}-${var.env_name}-s3-policy"
+  description = "IAM policy for S3 access for Lambda function"
+  policy      = data.aws_iam_policy_document.lambda_s3_policy.json
+}
+
+resource "aws_iam_role_policy_attachment" "s3_policy" {
+  role       = aws_iam_role.lambda_function_role.name
+  policy_arn = aws_iam_policy.lambda_s3_policy.arn
+}
+
 resource "aws_iam_policy" "lambda_secret_manager_policy" {
   name        = "${var.lambda_name}-${var.env_name}-secret-manager-policy"
   description = "IAM policy for Secret Manager access for Lambda function"