s3CrudPolicy allows using canned ACL for s3.PutObject

README.md

@@ -18,4 +18,4 @@ You can build serverless applications faster and further simplify your developme
 
 [Read the Development Guide](DEVELOPMENT_GUIDE.rst) for in-depth information on how to start making changes.
 
-[Join the SAM developers channel (#samdev) on Slack](https://awssamopensource.splashthat.com/) to collaborate with fellow community members and the AWS SAM team.
+[Join the SAM developers channel (#samdev) on Slack](https://join.slack.com/t/awsdevelopers/shared_invite/enQtMzg3NTc5OTM2MzcxLTdjYTdhYWE3OTQyYTU4Njk1ZWY4Y2ZjYjBhMTUxNGYzNDg5MWQ1ZTc5MTRlOGY0OTI4NTdlZTMwNmI5YTgwOGM/) to collaborate with fellow community members and the AWS SAM team.

docs/safe_lambda_deployments.rst

@@ -309,5 +309,24 @@ The CodeDeploy service will assume the new CodeDeployServiceRole to Invoke any P
 
   NOTE: The CodeDeployServiceRole only allows InvokeFunction on functions with names prefixed with  ``CodeDeployHook_``. For example,  you should name your Hook functions as such: ``CodeDeployHook_PreTrafficHook``.
 
+Production errors preventing deployments
+~~~~~~~~~
+In some situations, an issue that is happening in production may prevent you from deploying a fix. This may happen when a deployment happens when traffic is too low to register enough errors to trigger a roll back, or where someone is sending malicious traffic through to a lambda and you haven’t accounted for the scenario where they do. 
+
+When this happens, the alarm for errors in the current lambda version is in an error state, which will cause code deploy to roll back any attempted deploys straight away.
+
+To release code in this situation, you need to
+
+- Go into the CodeDeploy console
+- Select the application you want to deploy to
+- Select the corresponding Deployment Group
+- Select “Edit”
+- Select “Advanced - optional”
+- Select "ignore alarm configuration"
+- Save the changes
+
+Run your deployment as usual
+
+Then once deployment has successfully run, return to the CodeDeploy console, and follow the above steps but this time deselect “ignore alarm configuration”.
 
 .. _Globals: globals.rst

samtranslator/policy_templates_data/policy_templates.json

@@ -334,6 +334,7 @@
               "s3:GetBucketLocation",
               "s3:GetObjectVersion",
               "s3:PutObject",
+              "s3:PutObjectAcl",
               "s3:GetLifecycleConfiguration",
               "s3:PutLifecycleConfiguration",
               "s3:DeleteObject"

tests/translator/output/all_policy_templates.json

@@ -264,12 +264,13 @@
               "Statement": [
                 {
                   "Action": [
-                    "s3:GetObject",
-                    "s3:ListBucket",
-                    "s3:GetBucketLocation",
-                    "s3:GetObjectVersion",
-                    "s3:PutObject",
-                    "s3:GetLifecycleConfiguration",
+                    "s3:GetObject", 
+                    "s3:ListBucket", 
+                    "s3:GetBucketLocation", 
+                    "s3:GetObjectVersion", 
+                    "s3:PutObject", 
+                    "s3:PutObjectAcl",
+                    "s3:GetLifecycleConfiguration", 
                     "s3:PutLifecycleConfiguration",
                     "s3:DeleteObject"
                   ],

tests/translator/output/aws-cn/all_policy_templates.json

@@ -263,12 +263,13 @@
               "Statement": [
                 {
                   "Action": [
-                    "s3:GetObject",
-                    "s3:ListBucket",
-                    "s3:GetBucketLocation",
-                    "s3:GetObjectVersion",
-                    "s3:PutObject",
-                    "s3:GetLifecycleConfiguration",
+                    "s3:GetObject", 
+                    "s3:ListBucket", 
+                    "s3:GetBucketLocation", 
+                    "s3:GetObjectVersion", 
+                    "s3:PutObject", 
+                    "s3:PutObjectAcl",
+                    "s3:GetLifecycleConfiguration", 
                     "s3:PutLifecycleConfiguration",
                     "s3:DeleteObject"
                   ],

tests/translator/output/aws-us-gov/all_policy_templates.json

@@ -263,12 +263,13 @@
               "Statement": [
                 {
                   "Action": [
-                    "s3:GetObject",
-                    "s3:ListBucket",
-                    "s3:GetBucketLocation",
-                    "s3:GetObjectVersion",
-                    "s3:PutObject",
-                    "s3:GetLifecycleConfiguration",
+                    "s3:GetObject", 
+                    "s3:ListBucket", 
+                    "s3:GetBucketLocation", 
+                    "s3:GetObjectVersion", 
+                    "s3:PutObject", 
+                    "s3:PutObjectAcl",
+                    "s3:GetLifecycleConfiguration", 
                     "s3:PutLifecycleConfiguration",
                     "s3:DeleteObject"
                   ],