From 7838178ec404d5483ddde6952067c1dc516d0ab2 Mon Sep 17 00:00:00 2001
From: Russell Ballestrini <russell.ballestrini@coursemojo.com>
Date: Tue, 5 Dec 2023 11:17:20 -0500
Subject: [PATCH] read access on bucket to start. 	modified:  
 template.yaml

---
 template.yaml | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/template.yaml b/template.yaml
index 63c34c2..7a5b844 100644
--- a/template.yaml
+++ b/template.yaml
@@ -25,6 +25,9 @@ Parameters:
   KeyPairName:
     Type: AWS::EC2::KeyPair::KeyName
     Description: The name of the EC2 KeyPair to allow SSH access to the instance.
+  S3BucketName:
+    Type: String
+    Description: The name of the S3 bucket to which the instance will have read access.
 
 Resources:
   EC2InstanceSecurityGroup:
@@ -65,6 +68,18 @@ Resources:
                 Action:
                   - "bedrock:InvokeModelWithResponseStream"
                 Resource: "*"
+        - PolicyName: S3BucketReadOnlyPolicy
+          PolicyDocument:
+            Version: '2012-10-17'
+            Statement:
+              - Sid: "S3BucketRead"
+                Effect: "Allow"
+                Action:
+                  - "s3:GetObject"
+                  - "s3:ListBucket"
+                Resource:
+                  - !Sub "arn:aws:s3:::${S3BucketName}"
+                  - !Sub "arn:aws:s3:::${S3BucketName}/*"
 
   InstanceProfile:
     Type: AWS::IAM::InstanceProfile