Allow customization of IAM func role

[tj]

Pretty common to add dynamo/kinesis/s3 access etc, probably time to add this to up.json so people don't have to use the AWS console to manipulate the permissions.

• add support for defining perms
• add docs and examples
• add to json schema

[kaihendry]

Is it acceptable just to add the permissions to the up role in the AWS IAM console, after deploying? It persists IIRC.

[tj]

Yep! That's what I've been doing too

[mgoodings]

Would save a lot of additional work on our end if we could override the IAM role pragmatically. Currently have to deploy a whole CloudFormation stack to create the role and somehow wire it into Up.

[tj]

I'll prioritize this some more, pretty common to add Dynamo etc and it shouldn't take long to add—I always end up manually tweaking mine in the console but yeah that's not ideal haha.

[mgoodings]

Any expected ETA on this one? Sorry to pressure.

[tj]

@mgoodings I'm not sure yet how to best handle this since it's not part of the CloudFormation stack, it wouldn't be part of the up stack plan/apply workflow because of that which makes it a little awkward :'(. Might be able to manually add it to plan/apply and "fake it" but that's kind of a gross solution as well.

[kaihendry]

Just a note that 9f4faca seems to overwrite my edits to the function's inline policy. Didn't expect that. 😅