fix(custom-resource): provider framework lambda missing GetFunction permission

[samson-keung]

Issue # (if applicable)

Closes #26838.

Reason for this change

In the Provider Framework lambda code, there is a logic to catch error arise from invoking the User Defined handler lambda. Upon error, it polls the state of the User Defined handler until it is in ACTIVE state (#22612 added this logic):

aws-cdk/packages/aws-cdk-lib/custom-resources/lib/provider-framework/runtime/outbound.ts

Lines 66 to 80 in 64b865b

	} catch {
	/**
	* The status of the Lambda function is checked every second for up to 300 seconds.
	* Exits the loop on 'Active' state and throws an error on 'Inactive' or 'Failed'.
	*
	* And now we wait.
	*/
	await waitUntilFunctionActiveV2({
	client: lambda,
	maxWaitTime: 300,
	}, {
	FunctionName: req.FunctionName,
	});
	return lambda.invoke(req);
	}

The polling uses the AWS SDK waitUntilFunctionActiveV2 function, which calls the Lambda GetFunction API:
https://github.com/aws/aws-sdk-js-v3/blob/6858c7e04730a2b524b06355969e4076c28ae863/clients/client-lambda/src/waiters/waitForFunctionActiveV2.ts#L57

However, the Provider Framework lambda does not have the lambda:GetFunction permission.

Why is the issue saying the lambda:GetFunctionConfiguration is needed instead of lambda:GetFunction?

At some point in time, the retry logic used waitUntilFunctionActive for polling, which use the GetFunctionConfiguration. But this is no longer the case after c3a4b7b#diff-85920270c638d83b082246e0026f1a316dd39aaa3cd8720fdaeb3d526e438f7fR66

Description of changes

Added the lambda:GetFunction permission on the role used by the Provider Framework lambda.

Describe any new or updated permissions being added

The lambda:GetFunction permission is added.

Description of how you validated changes

There isn't a straight forward way to test the INACTIVE lambda scenario as one need to wait 14 days for a Lambda function to become INACTIVE. Therefore, I am not able to create an integ test.

What I did was locally changing the Provider Framework lambda code to throw an error such that it executes the catch block. Then I verified in CloudTrail that the Provider Framework lambda called GetFunction successfully and then it was also able to invoke the User Defined Handler lambda.

Checklist

• My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[aws-cdk-automation]

The pull request linter fails with the following errors:

❌ Fixes must contain a change to an integration test file and the resulting snapshot.

If you believe this pull request should receive an exemption, please comment and provide a justification. A comment requesting an exemption should contain the text Exemption Request. Additionally, if clarification is needed, add Clarification Request to a comment.

✅ A exemption request has been requested. Please wait for a maintainer's review.

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 81.46%. Comparing base (e5ac918) to head (fe11b92).

Additional details and impacted files

@@           Coverage Diff           @@
##             main   #32904   +/-   ##
=======================================
  Coverage   81.46%   81.46%           
=======================================
  Files         224      224           
  Lines       13748    13748           
  Branches     2412     2412           
=======================================
  Hits        11200    11200           
  Misses       2273     2273           
  Partials      275      275           

Flag	Coverage Δ
suite.unit	81.46% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

Components	Coverage Δ
packages/aws-cdk	80.85% <ø> (ø)
packages/aws-cdk-lib/core	82.10% <ø> (ø)

[aws-cdk-automation]

The pull request linter fails with the following errors:

❌ Fixes must contain a change to an integration test file and the resulting snapshot.

PRs must pass status checks before we can provide a meaningful review.

If you would like to request an exemption from the status checks or clarification on feedback, please leave a comment on this PR containing Exemption Request and/or Clarification Request.

[samson-keung]

Exemption Request

It requires waiting 14 days for a lambda to be in INACTIVE state. Therefore, we don't have a way to integ test this change.

[moelasmar]

In general the change looks good, I left a minor comment

[aws-cdk-automation]

AWS CodeBuild CI Report

• CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
• Commit ID: fe11b92
• Result: SUCCEEDED
• Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

[mergify]

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[github-actions]

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.