chore: update policy

Signed-off-by: Adetokunbo Ige <[email protected]>

Author: Adetokunbo Ige

todo-app/__main__.py

@@ -11,33 +11,10 @@
 docker_image = config.get("docker_image")
 environment = config.get("environment")
 
-# Create an IAM Role for the Lambda function
-lambda_role = aws.iam.Role("lambdaExecutionRole",
-    assume_role_policy="""{
-      "Version": "2012-10-17",
-      "Statement": [
-        {
-          "Action": "sts:AssumeRole",
-          "Principal": {
-            "Service": "lambda.amazonaws.com"
-          },
-          "Effect": "Allow",
-          "Sid": ""
-        }
-      ]
-    }"""
-)
-
-# Attach the basic execution policy to the role
-lambda_policy_attachment = aws.iam.RolePolicyAttachment("lambdaExecutionPolicy",
-    role=lambda_role.name,
-    policy_arn="arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
-)
-
-# Define a DynamoDB table
+# First create the DynamoDB table
 dynamodb_table = aws.dynamodb.Table(
     f"todo-{environment}",
-    name=f"todo-{environment}",  # Explicit table name
+    name=f"todo-{environment}",
     hash_key="id",
     range_key="timestamp",
     attributes=[
@@ -57,11 +34,26 @@
     }
 )
 
-# 3. Create DynamoDB policy
-dynamodb_policy = aws.iam.Policy(
-    "dynamodb-policy",
-    name=f"dynamodb-policy-{environment}",
-    description="Policy for DynamoDB access",
+# Create Lambda execution role
+lambda_role = aws.iam.Role(
+    "lambdaExecutionRole",
+    assume_role_policy=json.dumps({
+        "Version": "2012-10-17",
+        "Statement": [{
+            "Action": "sts:AssumeRole",
+            "Principal": {
+                "Service": "lambda.amazonaws.com"
+            },
+            "Effect": "Allow",
+            "Sid": ""
+        }]
+    })
+)
+
+# Create inline policy for the role instead of a managed policy
+dynamodb_policy = aws.iam.RolePolicy(
+    "lambdaRolePolicy",
+    role=lambda_role.id,
     policy=pulumi.Output.json_dumps({
         "Version": "2012-10-17",
         "Statement": [
@@ -79,6 +71,15 @@
                     dynamodb_table.arn,
                     pulumi.Output.concat(dynamodb_table.arn, "/*")
                 ]
+            },
+            {
+                "Effect": "Allow",
+                "Action": [
+                    "logs:CreateLogGroup",
+                    "logs:CreateLogStream",
+                    "logs:PutLogEvents"
+                ],
+                "Resource": "arn:aws:logs:*:*:*"
             }
         ]
     })