This gist contains code from the file lambda.tf which is part of the blog-photo-location-map repository.

blog-photo-location-map-lambda-02.tf

resource "aws_iam_policy" "lambda_policy" {
  name = "${local.lambda_function_name_prefix}-lambda-policy"

  policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "logs:CreateLogGroup",
      "Resource": "arn:aws:logs:${local.region}:${local.account_id}:*"
    },
    {
      "Effect": "Allow",
      "Action": [
          "logs:CreateLogStream",
          "logs:PutLogEvents"
      ],
      "Resource": "arn:aws:logs:${local.region}:${local.account_id}:log-group:/aws/lambda/${local.lambda_function_name_prefix}-*:*"
    },
    {
      "Sid": "GetPutS3Objects",
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:PutObject",
        "s3:ListBucket"
      ],
      "Resource": "arn:aws:s3:::${local.website_s3_bucket_name}/*"
    },
    {
      "Sid": "ListS3Objects",
      "Effect": "Allow",
      "Action": [
        "s3:ListBucket"
      ],
      "Resource": "arn:aws:s3:::${local.website_s3_bucket_name}"
    }
  ]
}
EOF
}