fix(cdk): grant lambda Put/DeleteProvisionedConcurrencyConfig (#409) (#410)

The Slack-events function pins provisioned concurrency on its `live` alias
(AWS::Lambda::Alias with ProvisionedConcurrencyConfig), so CloudFormation
issues lambda:PutProvisionedConcurrencyConfig at create. The Lambda statement
in the bootstrap policy granted only lambda:GetProvisionedConcurrencyConfig,
so a fresh `mise //cdk:bootstrap` + deploy of current main rolls back with:

  cdk-hnb659fds-cfn-exec-role is not authorized to perform
  lambda:PutProvisionedConcurrencyConfig

Add Put/DeleteProvisionedConcurrencyConfig next to the existing Get verb
(resource ARN function:backgroundagent-dev-* is already covered), regenerate
bootstrap artifacts, update the DEPLOYMENT_ROLES.md golden (+ mirror), and add
a regression guard.

Fourth instance of bootstrap allow-list drift (after #403, #405, #408).

Fixes #409

Co-authored-by: bgagent <bgagent@noreply.github.com>
Co-authored-by: Alain Krok <alkrok@amazon.com>

Author: 3 people

cdk/bootstrap/bootstrap-template.yaml

@@ -1002,6 +1002,8 @@ Resources:
               - lambda:GetFunctionCodeSigningConfig
               - lambda:GetFunctionRecursionConfig
               - lambda:GetProvisionedConcurrencyConfig
+              - lambda:PutProvisionedConcurrencyConfig
+              - lambda:DeleteProvisionedConcurrencyConfig
               - lambda:GetRuntimeManagementConfig
               - lambda:ListVersionsByFunction
               - lambda:InvokeFunction

cdk/bootstrap/policies/application.json

@@ -50,6 +50,8 @@
         "lambda:GetFunctionCodeSigningConfig",
         "lambda:GetFunctionRecursionConfig",
         "lambda:GetProvisionedConcurrencyConfig",
+        "lambda:PutProvisionedConcurrencyConfig",
+        "lambda:DeleteProvisionedConcurrencyConfig",
         "lambda:GetRuntimeManagementConfig",
         "lambda:ListVersionsByFunction",
         "lambda:InvokeFunction",

cdk/src/bootstrap/policies/application.ts

@@ -84,6 +84,8 @@ export function applicationPolicy(): iam.PolicyDocument {
           'lambda:GetFunctionCodeSigningConfig',
           'lambda:GetFunctionRecursionConfig',
           'lambda:GetProvisionedConcurrencyConfig',
+          'lambda:PutProvisionedConcurrencyConfig',
+          'lambda:DeleteProvisionedConcurrencyConfig',
           'lambda:GetRuntimeManagementConfig',
           'lambda:ListVersionsByFunction',
           'lambda:InvokeFunction',

cdk/test/bootstrap/policies.test.ts

@@ -149,6 +149,20 @@ describe('IaCRole-ABCA-Application', () => {
     );
   });
 
+  it('grants Put/Delete provisioned-concurrency, not just Get (#409)', () => {
+    // The Slack-events function pins provisioned concurrency on its `live`
+    // alias, so the exec role needs Put (create/update) and Delete (removal),
+    // not only the Get verb. Get-without-Put rolled the deploy back with
+    // AccessDenied on lambda:PutProvisionedConcurrencyConfig.
+    const resolvedDoc = stack.resolve(doc);
+    const statements = resolvedDoc.Statement as Array<{ Action: string | string[] }>;
+    const allActions = statements.flatMap((s) =>
+      Array.isArray(s.Action) ? s.Action : [s.Action],
+    );
+    expect(allActions).toContain('lambda:PutProvisionedConcurrencyConfig');
+    expect(allActions).toContain('lambda:DeleteProvisionedConcurrencyConfig');
+  });
+
   it('LambdaEventSourceMappings grants tagging (CDK event-source constructs tag the mapping)', () => {
     // Regression guard for #407: DynamoDBEventSource (and peers) tag the
     // created event source mapping, so the exec role needs Tag/UntagResource

docs/design/DEPLOYMENT_ROLES.md

@@ -319,6 +319,8 @@ DynamoDB tables, Lambda functions, API Gateway, Cognito, WAFv2, EventBridge, SQS
         "lambda:GetFunctionCodeSigningConfig",
         "lambda:GetFunctionRecursionConfig",
         "lambda:GetProvisionedConcurrencyConfig",
+        "lambda:PutProvisionedConcurrencyConfig",
+        "lambda:DeleteProvisionedConcurrencyConfig",
         "lambda:GetRuntimeManagementConfig",
         "lambda:ListVersionsByFunction",
         "lambda:InvokeFunction",

docs/src/content/docs/architecture/Deployment-roles.md

@@ -323,6 +323,8 @@ DynamoDB tables, Lambda functions, API Gateway, Cognito, WAFv2, EventBridge, SQS
         "lambda:GetFunctionCodeSigningConfig",
         "lambda:GetFunctionRecursionConfig",
         "lambda:GetProvisionedConcurrencyConfig",
+        "lambda:PutProvisionedConcurrencyConfig",
+        "lambda:DeleteProvisionedConcurrencyConfig",
         "lambda:GetRuntimeManagementConfig",
         "lambda:ListVersionsByFunction",
         "lambda:InvokeFunction",