fix: s3 perm requires ARN not bucket name

Author: theburningmonk

lib/package/s3/compileIamRoleToS3.js

@@ -2,6 +2,18 @@
 
 const _ = require('lodash')
 
+function convertToArn(bucket) {
+  // bucket can be either a Ref, or a string (bucket name)
+  if (bucket.Ref) {
+    const logicalId = bucket.Ref
+    return {
+      'Fn::GetAtt': [logicalId, 'Arn']
+    }
+  } else {
+    return `arn:aws:s3:::${bucket}`
+  }
+}
+
 module.exports = {
   compileIamRoleToS3() {
     const bucketActions = _.flatMap(this.getAllServiceProxies(), (serviceProxy) => {
@@ -29,7 +41,7 @@ module.exports = {
           'Fn::Sub': [
             '${bucket}/*',
             {
-              bucket
+              bucket: convertToArn(bucket)
             }
           ]
         }

lib/package/s3/compileIamRoleToS3.test.js

@@ -102,7 +102,7 @@ describe('#compileIamRoleToS3()', () => {
                       'Fn::Sub': [
                         '${bucket}/*',
                         {
-                          bucket: 'myBucket'
+                          bucket: 'arn:aws:s3:::myBucket'
                         }
                       ]
                     }
@@ -114,7 +114,7 @@ describe('#compileIamRoleToS3()', () => {
                       'Fn::Sub': [
                         '${bucket}/*',
                         {
-                          bucket: 'myBucket'
+                          bucket: 'arn:aws:s3:::myBucket'
                         }
                       ]
                     }
@@ -127,7 +127,7 @@ describe('#compileIamRoleToS3()', () => {
                         '${bucket}/*',
                         {
                           bucket: {
-                            Ref: 'MyBucket'
+                            'Fn::GetAtt': ['MyBucket', 'Arn']
                           }
                         }
                       ]
@@ -140,7 +140,7 @@ describe('#compileIamRoleToS3()', () => {
                       'Fn::Sub': [
                         '${bucket}/*',
                         {
-                          bucket: 'myBucketV2'
+                          bucket: 'arn:aws:s3:::myBucketV2'
                         }
                       ]
                     }