concourse-resource-cloudformation.json

    "EtcdReleasesBucketPolicy": {
      "Type" : "AWS::S3::BucketPolicy",
      "Properties" : {
        "PolicyDocument" : {
          "Id" : "etcd-candidate-releases-bucket-policy",
          "Statement" : [ { 
            "Sid" : "AllowWrite",
            "Action" : [
              "s3:GetObject",
              "s3:PutObject"
            ],
            "Effect" : "Allow",
            "Principal" : {
              "AWS" : { "Fn::GetAtt" : [ "ConcourseUser", "Arn" ] }
            },
            "Resource" : { "Fn::Join" : [
              "", [ "arn:aws:s3:::", { "Ref" : "EtcdReleasesBucket" } , "/*" ]
            ] }
          },
          { 
            "Sid" : "AllowList",
            "Action" : [
              "s3:ListBucket"
            ],
            "Effect" : "Allow",
            "Principal" : {
              "AWS" : { "Fn::GetAtt" : [ "ConcourseUser", "Arn" ] }
            },
            "Resource" : { "Fn::Join" : [
              "", [ "arn:aws:s3:::", { "Ref" : "EtcdReleasesBucket" } ]
            ] }
          }]
        },
        "Bucket" : { "Ref" : "EtcdReleasesBucket" }
      }
    }