sample-addon-with-s3-policy.yaml

Parameters:
  App:
    Type: String
    Description: Your application's name.
  Env:
    Type: String
    Description: The environment name your service, job, or workflow is being deployed to.
  Name:
    Type: String
    Description: The name of the service, job, or workflow being deployed.

Resources:
  # Define the CopilotBucket as well here

  BucketAccessPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      PolicyName: CopilotBucketAccessPolicy
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Sid: ReadAccess
            Effect: Allow
            Action:
              - s3:GetObject
              - s3:ListBucket
              - s3:GetBucketPolicy
            Resource: !Sub ${ CopilotBucket.Arn}

Outputs:
  BucketAccessPolicyArn:
    Description: "The ARN of the ManagedPolicy to attach to the task role."
    Value: !Ref BucketAccessPolicy