s3_event_iam_role_serverless.yaml

# you can add statements to the Lambda function's IAM Role here
 iam:
   role:
     statements:
     - Effect: "Allow"
       Action:
         - "s3:ListBucket"
       Resource:
         - arn:aws:s3:::your-temporary-bucket-name
         - arn:aws:s3:::your-actual-photo-bucket-name
     - Effect: "Allow"
       Action:
         - "s3:GetObject"
         - "s3:DeleteObject"
       Resource: arn:aws:s3:::your-temporary-bucket-name/*
     - Effect: "Allow"
       Action:
         - "s3:PutObject"
       Resource: arn:aws:s3:::your-actual-photo-bucket-name/*
     - Effect: "Allow"
       Action:
         - "dynamodb:PutItem"
       Resource:
         - Fn::GetAtt: [ MetaDataDB, Arn ]