lambda-execution-role.yaml

# Lambda Execution Role
# Shared IAM role for all Lambda functions created by the RGD
# Provides permissions for DynamoDB, CloudWatch Logs, and X-Ray
#
# IMPORTANT: Replace placeholders before applying:
# - ${AWS_ACCOUNT_ID}: Your AWS account ID
# - ${AWS_REGION}: Your AWS region
#
apiVersion: iam.services.k8s.aws/v1alpha1
kind: Role
metadata:
  name: hkc-lambda-execution-role
  namespace: kro-serverless-stack
  labels:
    app.kubernetes.io/name: hkc-sample
    app.kubernetes.io/component: iam
    app.kubernetes.io/part-of: shared-platform
spec:
  name: hkc-lambda-execution-role
  description: "Shared Lambda execution role for Hybrid Kro Compositions"
  
  # Trust policy - allows Lambda service to assume this role
  assumeRolePolicyDocument: |
    {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Effect": "Allow",
          "Principal": {
            "Service": "lambda.amazonaws.com"
          },
          "Action": "sts:AssumeRole"
        }
      ]
    }
  
  # Inline policies (map format: policyName -> policyDocument)
  inlinePolicies:
    DynamoDBAccess: |
      {"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["dynamodb:GetItem","dynamodb:PutItem","dynamodb:UpdateItem","dynamodb:DeleteItem","dynamodb:Query","dynamodb:Scan","dynamodb:BatchGetItem","dynamodb:BatchWriteItem"],"Resource":["arn:aws:dynamodb:${AWS_REGION}:${AWS_ACCOUNT_ID}:table/*-inventory","arn:aws:dynamodb:${AWS_REGION}:${AWS_ACCOUNT_ID}:table/*-inventory/index/*"]}]}
    CloudWatchLogs: |
      {"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["logs:CreateLogGroup","logs:CreateLogStream","logs:PutLogEvents"],"Resource":"arn:aws:logs:${AWS_REGION}:${AWS_ACCOUNT_ID}:log-group:/aws/lambda/*:*"}]}
    XRayTracing: |
      {"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["xray:PutTraceSegments","xray:PutTelemetryRecords"],"Resource":"*"}]}
  
  # Tags
  tags:
    - key: Application
      value: hkc-sample
    - key: Component
      value: lambda-execution
    - key: ManagedBy
      value: ACK