fix(custom-resources): custom resource provider role needs lambda:GetFunction

[ejt4x]

Issue

Closes #26838.

Reason for this change

If the first invocation of the user lambda fails because the function is throttled or inactive, the provider function will fail with the error

CREATE_FAILED   Received response status [FAILED] from custom resource. Message returned: TimeoutError: {"state":"TIMEOUT","reason":"Waiter has timed out"} at checkExceptions ...

The following error can be seen in CloudTrail

User: arn:aws:sts::[redacted]:assumed-role/[providerFunctionRole] s not authorized to perform: lambda:GetFunction on resource: arn:aws:lambda:[redacted]:[redacted]:function:[userLambdaFunction] because no identity-based policy allows the lambda:GetFunction action

Description of changes

Adding lambda:GetFunction for the custom resource provider to check the status of the user lambda function if the initial invocation fails.

The waitUntilFunctionActiveV2 API call in the provider requires GetFunction to succeed.

aws-cdk/packages/aws-cdk-lib/custom-resources/lib/provider-framework/runtime/outbound.ts

Lines 60 to 72 in c3a4b7b

	/**
	* The status of the Lambda function is checked every second for up to 300 seconds.
	* Exits the loop on 'Active' state and throws an error on 'Inactive' or 'Failed'.
	*
	* And now we wait.
	*/
	await waitUntilFunctionActiveV2({
	client: lambda,
	maxWaitTime: 300,
	}, {
	FunctionName: req.FunctionName,
	});
	return await lambda.invoke(req);

Description of how you validated changes

Added unit test to validate the required IAM policy is present.

I'm not sure how to recreate this with integration testing. Is there a way to simulate function throttling?

Checklist

• My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[aws-cdk-automation]

The pull request linter has failed. See the aws-cdk-automation comment below for failure reasons. If you believe this pull request should receive an exemption, please comment and provide a justification.

A comment requesting an exemption should contain the text Exemption Request. Additionally, if clarification is needed add Clarification Request to a comment.

[aws-cdk-automation]

AWS CodeBuild CI Report

• CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
• Commit ID: 87e0e15
• Result: FAILED
• Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

[aws-cdk-automation]

This PR has been in the CHANGES REQUESTED state for 3 weeks, and looks abandoned. To keep this PR from being closed, please continue work on it. If not, it will automatically be closed in a week.

[aws-cdk-automation]

This PR has been deemed to be abandoned, and will be automatically closed. Please create a new PR for these changes if you think this decision has been made in error.

[aws-cdk-automation]

The pull request linter fails with the following errors:

❌ Fixes must contain a change to an integration test file and the resulting snapshot.

PRs must pass status checks before we can provide a meaningful review.

If you would like to request an exemption from the status checks or clarification on feedback, please leave a comment on this PR containing Exemption Request and/or Clarification Request.