Default policy generated for S3 putObject missing PutObjectAcl for unauthenticated requests

If I take a simple project like:

https://github.com/Schweigi/thumbnail-service

And deploy, access via CURL will always yield "PutObject operation: Access Denied"

```
$ curl -X POST -H "Content-Type: application/json" -d '{
"width": 64,
"height": 64,
"data": "'"$( base64 -i network_alt.png )"'"
}' "https://blablawahwah.execute-api.us-east-1.amazonaws.com/dev/"
{"stackTrace": [["/var/task/chalice/app.py", 258, "__call__", "response = view_function(*function_args)"], ["/var/task/app.py", 50, "index", "ContentType='image/{}'.format(format),"], ["/var/task/botocore/client.py", 251, "_api_call", "return self._make_api_call(operation_name, kwargs)"], ["/var/task/botocore/client.py", 537, "_make_api_call", "raise ClientError(parsed_response, operation_name)"]], "errorType": "ClientError", "errorMessage": "An error occurred (AccessDenied) when calling the PutObject operation: Access Denied"}(venv) $ vi ~/.aws/config
```

If I run "chalice gen-policy", I get:

```
{
"Version": "2012-10-17",
"Statement": [
{
"Action": [
"s3:PutObject"
],
"Resource": [
"*"
],
"Effect": "Allow",
"Sid": "somegreatuididididididid"
}
]
}
```

If I check my policy associated with this role, it has PutObject and cloudwatch policies. This is not sufficient to access the S3 bucket (newly created, no additional bucket policies set).

I am getting my head around this, but if I understand correctly, this "should" work as is, if I were authenticating my client request? And that it should NOT work unless we add PutObjectAcl? Please clarify. Should the policy generated include PutObjectAcl? It should save some head scratching.

Start by reproducing the thumbnail-service example and running the `chalice gen-policy` entry point shown in the issue. Compare the generated policy with the S3 request and determine the required behavior for authenticated and unauthenticated PutObject requests. Done means the policy output and its expected S3 access behavior are clearly aligned, with coverage for the reported case.

Written by the indexing model from the issue text.