aws-cdk-lib/aws-lambda: managed policies for deadLetterTopic

[bitowaqr]

Describe the feature

When setting a deadLetterTopic in lambda.Function, an inline policy is created. From buildDeadLetterQueue:

if (props.deadLetterTopic) {
      deadLetterQueue = props.deadLetterTopic;
      this.addToRolePolicy(new iam.PolicyStatement({
        actions: ['sns:Publish'],
        resources: [deadLetterQueue.topicArn],
      }));

Some compliance packages require using managed policies only.

Use Case

Building hipaa compliant applications requires using managed policies only. It also requires using dead letter queues. I can't seem to make the two work at the same time.

Proposed Solution

Let me define a role in sns.ITopic

Other Information

No response

Acknowledgements

• I may be able to implement this feature request
• This feature might incur a breaking change

CDK version used

2.90.0

Environment details (OS name and version, etc.)

na

[peterwoodworth]

The role this policy is being added to is the Lambda service role

aws-cdk/packages/aws-cdk-lib/aws-lambda/lib/function.ts

Line 716 in 724bd01

this.role = props.role || new iam.Role(this, 'ServiceRole', {

.

You have a couple options. You can provide your own role to the function while calling withoutPolicyUpdates to ensure the role won't have any more policies attached to it. This is the official solution for when undesired policies are added to a role

Alternatively, you could modify this role with escape hatches to remove any policies like so:

    fn.role?.node.tryRemoveChild('DefaultPolicy');

Let me know if both of these solutions are lacking and a feature request is still desired

[bitowaqr]

Sorry, my mistake. I must have used withoutPolicyUpdates wrong somehow. Now it suddenly works fine ...Thanks so much for the quick response!

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.