effect: Effect.ALLOW, actions: [ 's3:*', ], resources: [ destinationBucket.bucketArn, `${destinationBucket.bucketArn}/*`, ], })] }), } }); lambdaRole.addManagedPolicy( cdk.aws_iam.ManagedPolicy.fromAwsManagedPolicyName( 'service-role/AWSLambdaBasicExecutionRole' )); // IAM Role for Lambda const lambdaRole = new Role(this, 'LambdaRole', { roleName: `${props?.projectName}-lambda-role`, assumedBy: new ServicePrincipal('lambda.amazonaws.com'), inlinePolicies: { ReadOnlySourceBucket: new PolicyDocument({ statements: [new PolicyStatement({ effect: Effect.ALLOW, actions: [ 's3:Get*', 's3:List*', ], resources: [ sourceBucket.bucketArn, `${sourceBucket.bucketArn}/*`, ], })] }), l LambdaにアタッチするIAMロールを定義