Fix SSM Agent ability to upload to S3 for output associations (#12)

* Add IAM Role Inline Policy to allow actions on target s3 bucket for ssm output associations

* SSM S3 Associations Output is environment-independent

* Fix the name: it ends with -output

* ${var.project} is not part of the ssm associations output S3 bucket name

Author: pmatsinopoulos

terraform/data.tf

@@ -48,3 +48,7 @@ data "aws_iam_policy" "cloudwatch_logs_full_access" {
 data "aws_iam_policy" "ssm_managed_instance_core" {
   arn = "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore"
 }
+
+data "aws_s3_bucket" "ssm_associations_output" {
+  bucket = "${var.company}-${var.core_infrastructure_project}-ssm-associations-output"
+}

terraform/ethereum_ec2_iam_role.tf

@@ -20,6 +20,29 @@ resource "aws_iam_role" "ethereum_node" {
   }
 }
 
+resource "aws_iam_role_policy" "ethereum_node" {
+  name = "${var.project}-${var.environment}-ethereum-node-inline-policy"
+  role = aws_iam_role.ethereum_node.id
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Effect = "Allow",
+        Action = [
+          "s3:PutObject",
+          "s3:GetObject",
+          "s3:ListBucket"
+        ],
+        Resource = [
+          "${data.aws_s3_bucket.ssm_associations_output.arn}",
+          "${data.aws_s3_bucket.ssm_associations_output.arn}/*"
+        ]
+      }
+    ]
+  })
+}
+
 resource "aws_iam_role_policy_attachment" "ethereum_node" {
   policy_arn = data.aws_iam_policy.cloudwatch_agent_server_policy.arn
   role       = aws_iam_role.ethereum_node.name