(custom-resources): support custom lambda role in provider framework

[Ruben-E]

My project uses custom resources with the provider framework to handle the callback to CloudFormation. Thanks for making that easier!

But the provider framework does not support a custom role for the lambda function yet.
We need it because the policy requires a permission boundary to be set on a role. Without permission boundary, roles cannot be created, including default roles.

Use Case

• To pass a custom role with a permission boundary to the lambda.

Proposed Solution

const aCustomRole = new iam.Role(this, 'CustomRole', {
    assumedBy: new ServicePrincipal('lambda.amazonaws.com'),
    managedPolicies: ...,
    permissionsBoundary: ...
});

const myProvider = new cr.Provider(this, 'MyProvider', {
    onEventHandler: onEvent,
    role: aCustomRole
});

Other

• 👋 I may be able to implement this feature request

---

This is a 🚀 Feature Request

[rix0rrr]

Aren't you better off using an escape hatch to add this PermissionBoundary field onto the generated role object? By the very nature of the framework being in the Core library it cannot use any of the IAM classes so it will be mostly string manipulation anyway.

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.