AWS SAM S3 Connector Read needs GetBucketLocation

[kitsunde]

Hello,

Athena needs GetBucketLocation and it's present in the S3 read template on https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/serverless-policy-template-list.html#s3-read-policy, but on the AWS Connector it doesn't get added.

Currently the connector read grants:

Allow: s3:GetObjectTorrent
Allow: s3:GetObjectVersion
Allow: s3:GetObject
Allow: s3:ListBucketMultipartUploads
Allow: s3:GetObjectVersionAcl
Allow: s3:GetObjectLegalHold
Allow: s3:ListBucket
Allow: s3:GetObjectVersionTorrent
Allow: s3:GetObjectVersionForReplication
Allow: s3:GetObjectRetention
Allow: s3:ListBucketVersions
Allow: s3:GetObjectAcl
Allow: s3:ListMultipartUploadParts

And the read policy template grants:

"s3:GetObject",
"s3:ListBucket",
"s3:GetBucketLocation",
"s3:GetObjectVersion",
"s3:GetLifecycleConfiguration"

The inconsistency between the policy templates and the connectors are unpredictable and confusing. It would be nice if these would match or one be a subsets of the other. It seems pretty arbitrary right now.