feat: use managed policy for Durable Functions (#3854)

bchampp · seshubaws · web-flow · commit 618a58e907b9 · 2025-12-04T15:46:27.000-08:00
Co-authored-by: seshubaws &lt;116689586+seshubaws@users.noreply.github.com&gt;
diff --git a/samtranslator/model/sam_resources.py b/samtranslator/model/sam_resources.py
@@ -789,7 +789,11 @@ def _construct_role(
             else IAMRolePolicies.lambda_assume_role_policy()
         )
 
-        managed_policy_arns = [ArnGenerator.generate_aws_managed_policy_arn("service-role/AWSLambdaBasicExecutionRole")]
+        managed_policy_arns = (
+            [ArnGenerator.generate_aws_managed_policy_arn("service-role/AWSLambdaBasicDurableExecutionRolePolicy")]
+            if self.DurableConfig
+            else [ArnGenerator.generate_aws_managed_policy_arn("service-role/AWSLambdaBasicExecutionRole")]
+        )
 
         tracing = intrinsics_resolver.resolve_parameter_refs(self.Tracing)
 
diff --git a/tests/translator/output/aws-cn/function_with_durable_config.json b/tests/translator/output/aws-cn/function_with_durable_config.json
@@ -46,7 +46,7 @@
           "Version": "2012-10-17"
         },
         "ManagedPolicyArns": [
-          "arn:aws-cn:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
+          "arn:aws-cn:iam::aws:policy/service-role/AWSLambdaBasicDurableExecutionRolePolicy"
         ],
         "Tags": [
           {
diff --git a/tests/translator/output/aws-cn/function_with_durable_config_globals.json b/tests/translator/output/aws-cn/function_with_durable_config_globals.json
@@ -46,7 +46,7 @@
           "Version": "2012-10-17"
         },
         "ManagedPolicyArns": [
-          "arn:aws-cn:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
+          "arn:aws-cn:iam::aws:policy/service-role/AWSLambdaBasicDurableExecutionRolePolicy"
         ],
         "Tags": [
           {
@@ -103,7 +103,7 @@
           "Version": "2012-10-17"
         },
         "ManagedPolicyArns": [
-          "arn:aws-cn:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
+          "arn:aws-cn:iam::aws:policy/service-role/AWSLambdaBasicDurableExecutionRolePolicy"
         ],
         "Tags": [
           {
@@ -160,7 +160,7 @@
           "Version": "2012-10-17"
         },
         "ManagedPolicyArns": [
-          "arn:aws-cn:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
+          "arn:aws-cn:iam::aws:policy/service-role/AWSLambdaBasicDurableExecutionRolePolicy"
         ],
         "Tags": [
           {
diff --git a/tests/translator/output/aws-cn/globals_for_function.json b/tests/translator/output/aws-cn/globals_for_function.json
@@ -116,7 +116,7 @@
           "Version": "2012-10-17"
         },
         "ManagedPolicyArns": [
-          "arn:aws-cn:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole",
+          "arn:aws-cn:iam::aws:policy/service-role/AWSLambdaBasicDurableExecutionRolePolicy",
           "arn:aws-cn:iam::aws:policy/AWSXRayDaemonWriteAccess",
           "arn:aws-cn:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole"
         ],
@@ -254,7 +254,7 @@
           "Version": "2012-10-17"
         },
         "ManagedPolicyArns": [
-          "arn:aws-cn:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole",
+          "arn:aws-cn:iam::aws:policy/service-role/AWSLambdaBasicDurableExecutionRolePolicy",
           "arn:aws-cn:iam::aws:policy/AWSXRayDaemonWriteAccess",
           "arn:aws-cn:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole"
         ],
diff --git a/tests/translator/output/aws-us-gov/function_with_durable_config.json b/tests/translator/output/aws-us-gov/function_with_durable_config.json
@@ -46,7 +46,7 @@
           "Version": "2012-10-17"
         },
         "ManagedPolicyArns": [
-          "arn:aws-us-gov:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
+          "arn:aws-us-gov:iam::aws:policy/service-role/AWSLambdaBasicDurableExecutionRolePolicy"
         ],
         "Tags": [
           {
diff --git a/tests/translator/output/aws-us-gov/function_with_durable_config_globals.json b/tests/translator/output/aws-us-gov/function_with_durable_config_globals.json
@@ -46,7 +46,7 @@
           "Version": "2012-10-17"
         },
         "ManagedPolicyArns": [
-          "arn:aws-us-gov:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
+          "arn:aws-us-gov:iam::aws:policy/service-role/AWSLambdaBasicDurableExecutionRolePolicy"
         ],
         "Tags": [
           {
@@ -103,7 +103,7 @@
           "Version": "2012-10-17"
         },
         "ManagedPolicyArns": [
-          "arn:aws-us-gov:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
+          "arn:aws-us-gov:iam::aws:policy/service-role/AWSLambdaBasicDurableExecutionRolePolicy"
         ],
         "Tags": [
           {
@@ -160,7 +160,7 @@
           "Version": "2012-10-17"
         },
         "ManagedPolicyArns": [
-          "arn:aws-us-gov:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
+          "arn:aws-us-gov:iam::aws:policy/service-role/AWSLambdaBasicDurableExecutionRolePolicy"
         ],
         "Tags": [
           {
diff --git a/tests/translator/output/aws-us-gov/globals_for_function.json b/tests/translator/output/aws-us-gov/globals_for_function.json
@@ -116,7 +116,7 @@
           "Version": "2012-10-17"
         },
         "ManagedPolicyArns": [
-          "arn:aws-us-gov:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole",
+          "arn:aws-us-gov:iam::aws:policy/service-role/AWSLambdaBasicDurableExecutionRolePolicy",
           "arn:aws-us-gov:iam::aws:policy/AWSXRayDaemonWriteAccess",
           "arn:aws-us-gov:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole"
         ],
@@ -254,7 +254,7 @@
           "Version": "2012-10-17"
         },
         "ManagedPolicyArns": [
-          "arn:aws-us-gov:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole",
+          "arn:aws-us-gov:iam::aws:policy/service-role/AWSLambdaBasicDurableExecutionRolePolicy",
           "arn:aws-us-gov:iam::aws:policy/AWSXRayDaemonWriteAccess",
           "arn:aws-us-gov:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole"
         ],
diff --git a/tests/translator/output/function_with_durable_config.json b/tests/translator/output/function_with_durable_config.json
@@ -46,7 +46,7 @@
           "Version": "2012-10-17"
         },
         "ManagedPolicyArns": [
-          "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
+          "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicDurableExecutionRolePolicy"
         ],
         "Tags": [
           {
diff --git a/tests/translator/output/function_with_durable_config_globals.json b/tests/translator/output/function_with_durable_config_globals.json
@@ -46,7 +46,7 @@
           "Version": "2012-10-17"
         },
         "ManagedPolicyArns": [
-          "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
+          "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicDurableExecutionRolePolicy"
         ],
         "Tags": [
           {
@@ -103,7 +103,7 @@
           "Version": "2012-10-17"
         },
         "ManagedPolicyArns": [
-          "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
+          "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicDurableExecutionRolePolicy"
         ],
         "Tags": [
           {
@@ -160,7 +160,7 @@
           "Version": "2012-10-17"
         },
         "ManagedPolicyArns": [
-          "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
+          "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicDurableExecutionRolePolicy"
         ],
         "Tags": [
           {
diff --git a/tests/translator/output/globals_for_function.json b/tests/translator/output/globals_for_function.json
@@ -116,7 +116,7 @@
           "Version": "2012-10-17"
         },
         "ManagedPolicyArns": [
-          "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole",
+          "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicDurableExecutionRolePolicy",
           "arn:aws:iam::aws:policy/AWSXrayWriteOnlyAccess",
           "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole"
         ],
@@ -254,7 +254,7 @@
           "Version": "2012-10-17"
         },
         "ManagedPolicyArns": [
-          "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole",
+          "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicDurableExecutionRolePolicy",
           "arn:aws:iam::aws:policy/AWSXrayWriteOnlyAccess",
           "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole"
         ],

Original file line number	Diff line number	Diff line change
`@@ -46,7 +46,7 @@`
`46`	`46`	`"Version": "2012-10-17"`
`47`	`47`	`},`
`48`	`48`	`"ManagedPolicyArns": [`
`49`		`- "arn:aws-cn:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"`
	`49`	`+ "arn:aws-cn:iam::aws:policy/service-role/AWSLambdaBasicDurableExecutionRolePolicy"`
`50`	`50`	`],`
`51`	`51`	`"Tags": [`
`52`	`52`	`{`