Fix: policy to access the S3 marts bucket

[lalver1]

Closes #185

Add a policy (as a Copilot addon) for accessing the S3 marts bucket from the ECS streamlit task via its Task role.

Notes

Using a ManagedPolicy is the most straightforward way to add permissions to the Copilot-created ECS streamlit TaskRole.
To see how the CloudFormation templates created by Copilot will look like when adding the s3-marts-access-policy addon, run

copilot svc package --name streamlit --env dev --output-dir .

from the infra folder. The command will create 3 files (parameters, main stack template, and addon stack template) in infra. The addon stack template is essentially the template in this PR (with a few formatting changes) and the main stack template and parameters are what the Copilot CLI will produce to send to CloudFormation to create the stack. The key section of the main stack, where the link is made with the permissions defined in the addon, is shown below

...
  TaskRole:
    Metadata:
      'aws:copilot:description': 'An IAM role to control permissions for the containers in your tasks'
    Type: AWS::IAM::Role
    Properties:
      ManagedPolicyArns:
        - Fn::GetAtt: [AddonsStack, Outputs.S3martsBucketAccessPolicyArn]
 ...

Note that there is no mention of the environment in the addon stack because accessing the S3 marts bucket is not dependent on the environment, all environments will access the same S3 bucket with the same permissions.

[github-actions]

Coverage report

This PR does not seem to contain any modification to coverable code.

[lalver1]

Change this to capital "S3"
Redundant since the policy was changed to a ManagedPolicy in 843eb60

[lalver1]

Modify this so that the policy is also added to test and prod
Redundant since the policy was changed to a ManagedPolicy in 843eb60

[lalver1]

@thekaveman I updated how we are giving permissions to the Task role that runs the streamlit ECS Task. Instead of using an inline policy (which requires assigning the policy explicitly to the dynamically named Task role), we now use a managed policy. The main advantage of a managed policy is that we don't need to manually keep track of the name of the Task role, Copilot automatically links the Task role with the managed policy we define in the addon. Copilot does not do this automatic linking with inline policies. I deployed the streamlit service manually to dev and this approach worked. It should also work with test and prod (the environment is passed as a parameter from the Copilot CLI) and because the policy is not dependent on the environment (we expect all 3 environments to be able to access the same S3 marts bucket) we don't need to make any changes to the template for test and prod deployments.

[thekaveman]

Incredible! Using a Managed Policy seems like the best approach 👍