add sopport to listObjects

Author: juancarle

lib/deploy/stepFunctions/compileIamRole.js

@@ -586,23 +586,33 @@ function getS3ObjectPermissions(action, state) {
   const bucket = state.Parameters.Bucket || '*';
   const key = state.Parameters.Key || '*';
   const prefix = state.Parameters.Prefix;
-  let arn;
+  let resource;
 
-  if (bucket === '*' && key === '*') {
-    arn = '*';
+  if (action === 's3:AmazonS3ReadOnlyAccess') {
+    action = [
+      's3:Get*',
+      's3:List*',
+      's3:Describe*',
+      's3-object-lambda:Get*',
+      's3-object-lambda:List*'
+    ],
+    resource = [
+      `arn:aws:s3:::${bucket}`,
+      `arn:aws:s3:::${bucket}/*`
+    ],
+  } else if (bucket === '*' && key === '*') {
+    resource = '*';
   } else if (prefix & key) {
-    arn = `arn:aws:s3:::${bucket}/${prefix}/${key}`;
+    resource = `arn:aws:s3:::${bucket}/${prefix}/${key}`;
   } else if (prefix) {
-    arn = `arn:aws:s3:::${bucket}/${prefix}`;
+    resource = `arn:aws:s3:::${bucket}/${prefix}`;
   } else {
-    arn = `arn:aws:s3:::${bucket}/${key}`;
+    resource = `arn:aws:s3:::${bucket}/${key}`;
   }
 
   return [{
     action,
-    resource: [
-      arn,
-    ],
+    resource,
   }];
 }