Revoke write access from cognito user roles

Right now, UUID and tags are are generated on the client side and s3 files are stored using the client's permission. This is not ideal as a bad actor could mess up a ton of data with just client credentials.

Instead, it would be better to have a lambda funciton exposed behind an API gateway that is authorized with a cognito authorizer. This function would accept requests from authorized users to generate a presigned POST url that would grant really tightly scoped write permissions for the client to upload the file to s3.

I don't want to allow lambda to directly upload the file as files could be very large. Better to let the client do the grunt work of an upload.

Don't forget to modify the cognito user role so they can only read from s3, no delete or editing is directly allowed. Must use lambda for that kind of stuff / get presigned url's from lambda.