bug: Upstream QSS Assets Not Accessible

[mbeacom]

The solution presently fails in the custom resource/lambda workflow when attempting to pull the packaged lambda assets from the upstream aws-ia/... S3 location as unauthorized while attempting to CopyObject out of the upstream bucket.

This means end users need to setup their own bucket with the packaged assets from this repository. This maybe due to an expected wildcard value in the upstream bucket's resource policy, but this is merely speculation.

[netcrazed]

A workaround for this is to use aws-ia-us-east-1 rather than aws-ia for the QSS3BucketName configuration param. They recently changed the default for that param and it appears that the new value is not quite ready yet as mentioned in the OP