fix(cdk): grant lambda Tag/UntagResource on event-source-mappings (#407) (#408)

CDK event-source constructs (e.g. DynamoDBEventSource) tag the created event
source mapping, so CloudFormation issues lambda:TagResource on
event-source-mapping:* during deploy. The LambdaEventSourceMappings statement
in the bootstrap policy grants Create/Delete/Update/Get on `*` but not the
tagging actions — and the lambda:TagResource granted elsewhere is scoped to
function:*/layer:*, which does not cover mappings. A fresh
`mise //cdk:bootstrap` + deploy of current main therefore rolls back deep into
the stack with:

  cdk-hnb659fds-cfn-exec-role is not authorized to perform lambda:TagResource
  on event-source-mapping:*

Add lambda:TagResource and lambda:UntagResource to the
LambdaEventSourceMappings statement (resources already `*`), regenerate
bootstrap artifacts, and update the DEPLOYMENT_ROLES.md golden (+ Starlight
mirror). Add a regression guard in policies.test.ts.

Third instance of the same bootstrap-drift class as #402/#403 and #404/#405;
root-cause CI gap tracked in #406.

Fixes #407

Co-authored-by: bgagent <bgagent@noreply.github.com>

Author: isadeks

cdk/bootstrap/bootstrap-template.yaml

@@ -1019,6 +1019,8 @@ Resources:
               - lambda:DeleteEventSourceMapping
               - lambda:UpdateEventSourceMapping
               - lambda:GetEventSourceMapping
+              - lambda:TagResource
+              - lambda:UntagResource
             Effect: Allow
             Resource: '*'
             Sid: LambdaEventSourceMappings

cdk/bootstrap/policies/application.json

@@ -70,7 +70,9 @@
         "lambda:CreateEventSourceMapping",
         "lambda:DeleteEventSourceMapping",
         "lambda:UpdateEventSourceMapping",
-        "lambda:GetEventSourceMapping"
+        "lambda:GetEventSourceMapping",
+        "lambda:TagResource",
+        "lambda:UntagResource"
       ],
       "Effect": "Allow",
       "Resource": "*",

cdk/src/bootstrap/policies/application.ts

@@ -106,6 +106,12 @@ export function applicationPolicy(): iam.PolicyDocument {
           'lambda:DeleteEventSourceMapping',
           'lambda:UpdateEventSourceMapping',
           'lambda:GetEventSourceMapping',
+          // CDK event-source constructs (e.g. DynamoDBEventSource) tag the
+          // created mapping, so the exec role needs Tag/UntagResource on
+          // event-source-mapping:* (the function:*/layer:*-scoped TagResource
+          // grant elsewhere in this policy does not cover mappings).
+          'lambda:TagResource',
+          'lambda:UntagResource',
         ],
         resources: ['*'],
       }),

cdk/test/bootstrap/policies.test.ts

@@ -149,6 +149,22 @@ describe('IaCRole-ABCA-Application', () => {
     );
   });
 
+  it('LambdaEventSourceMappings grants tagging (CDK event-source constructs tag the mapping)', () => {
+    // Regression guard for #407: DynamoDBEventSource (and peers) tag the
+    // created event source mapping, so the exec role needs Tag/UntagResource
+    // on event-source-mapping:*. The TagResource granted elsewhere is scoped
+    // to function:*/layer:* and does not cover mappings, so a fresh deploy
+    // rolled back with AccessDenied on lambda:TagResource. Lock the contract.
+    const resolvedDoc = stack.resolve(doc);
+    const statements = resolvedDoc.Statement as Array<{ Sid: string; Action?: string | string[] }>;
+    const esm = statements.find((s) => s.Sid === 'LambdaEventSourceMappings');
+    expect(esm).toBeDefined();
+
+    const actions = Array.isArray(esm!.Action) ? esm!.Action : [esm!.Action];
+    expect(actions).toContain('lambda:TagResource');
+    expect(actions).toContain('lambda:UntagResource');
+  });
+
   it('SecretsManager statement allow-lists a secret pattern for every integration that creates a secret', () => {
     // Regression guard for #402: each integration construct that creates a
     // Secrets Manager secret (GitHub token, Slack, Linear, Jira, GitHub

docs/design/DEPLOYMENT_ROLES.md

@@ -339,7 +339,9 @@ DynamoDB tables, Lambda functions, API Gateway, Cognito, WAFv2, EventBridge, SQS
         "lambda:CreateEventSourceMapping",
         "lambda:DeleteEventSourceMapping",
         "lambda:UpdateEventSourceMapping",
-        "lambda:GetEventSourceMapping"
+        "lambda:GetEventSourceMapping",
+        "lambda:TagResource",
+        "lambda:UntagResource"
       ],
       "Resource": "*"
     },

docs/src/content/docs/architecture/Deployment-roles.md

@@ -343,7 +343,9 @@ DynamoDB tables, Lambda functions, API Gateway, Cognito, WAFv2, EventBridge, SQS
         "lambda:CreateEventSourceMapping",
         "lambda:DeleteEventSourceMapping",
         "lambda:UpdateEventSourceMapping",
-        "lambda:GetEventSourceMapping"
+        "lambda:GetEventSourceMapping",
+        "lambda:TagResource",
+        "lambda:UntagResource"
       ],
       "Resource": "*"
     },