Support authenticated S3 access for user assets

[mattkrick]

Requirements (for S3):

• Parabol will only use a single S3 Bucket
• Within that bucket, all assets in the /build directory (e.g. HTML, JS, CSS) are publicly accessible so users are able to visit the app and login
• Within that bucket, all assets in the /store directory (e.g. user uploaded avatars) are only accessible to users logged into Parabol

Approach:

• All asset URLs will get presigned before they are sent to the client. The presigned URL will have an expiration of 1 week.
• Platform 1 will set an S3 Bucket policy that makes the /build directory public and the /store directory private. The AWS_SECRET_ACCESS_KEY will refer to an S3 User that has write permissions to that bucket

[mattkrick]

S3 Policies to implement

<<BUCKET>>:  name of the bucket in S3
<<ENV>>   :  name of the production environment, e.g. `pre-prod`, `production`, etc. it is the part following the last `/` in `CDN_BASE_URL`  

BUCKET POLICY

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "PublicBuild",
            "Effect": "Allow",
            "Principal": "*",
            "Action": "s3:GetObject",
            "Resource": [
                "arn:aws:s3:::<<BUCKET>>",
                "arn:aws:s3:::<<BUCKET>>/<<ENV>>/build/*"
            ]
        }
    ]
}

USER POLICY

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:GetObject", "s3:PutObject", "s3:ListBucket"],
      "Resource": ["arn:aws:s3:::<<BUCKET>>"]
    }
  ]
}