As the second part of this picture-resizing system, we need to create an endpoint that will let our users upload their pictures to the S3 bucket. As we explained at the beginning, there is no need to develop any custom software for that because API Gateway, besides executing Lambda functions, also lets us expose some of AWS APIs to public the internet. It means, we can let API Gateway clients use the S3 upload API on our behalf.
How can we configure this? First, we have to create a new role that can be assumed by API Gateway and only grants s3:PutObject and s3:PutObjectAcl permissions to our profile pictures bucket. Let's add this permission to our Resources section of the CloudFormation template:
"ApiGatewayProxyRole": {
"Type": "AWS::IAM::Role",
"Properties": {
"AssumeRolePolicyDocument...
