feat(codedeploy): change LambdaDeploymentGroup default managed policy to AWSCodeDeployRoleForLambdaLimited (#10276)

The managed policy `AWSCodeDeployRoleForLambda` used for Lambda deployments has broad permissions, providing publish access to all SNS topics within the customer's accounts.
This change replaces that with a new policy `AWSCodeDeployRoleForLambdaLimited` which removes those permissions.
This should be safe, as the SNS publish permission is only ever used when setting up `triggers`,
and we don't support that feature in `LambdaDeploymentGroup`.

BREAKING CHANGE: the default policy for `LambdaDeploymentGroup` no longer contains `sns:Publish` on `*` permissions

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

Author: vrr-21

packages/@aws-cdk/aws-codedeploy/lib/lambda/deployment-group.ts

@@ -158,7 +158,7 @@ export class LambdaDeploymentGroup extends cdk.Resource implements ILambdaDeploy
       assumedBy: new iam.ServicePrincipal('codedeploy.amazonaws.com'),
     });
 
-    this.role.addManagedPolicy(iam.ManagedPolicy.fromAwsManagedPolicyName('service-role/AWSCodeDeployRoleForLambda'));
+    this.role.addManagedPolicy(iam.ManagedPolicy.fromAwsManagedPolicyName('service-role/AWSCodeDeployRoleForLambdaLimited'));
     this.deploymentConfig = props.deploymentConfig || LambdaDeploymentConfig.CANARY_10PERCENT_5MINUTES;
 
     const resource = new CfnDeploymentGroup(this, 'Resource', {

packages/@aws-cdk/aws-codedeploy/test/lambda/integ.deployment-group.expected.json

@@ -468,7 +468,7 @@
                 {
                   "Ref": "AWS::Partition"
                 },
-                ":iam::aws:policy/service-role/AWSCodeDeployRoleForLambda"
+                ":iam::aws:policy/service-role/AWSCodeDeployRoleForLambdaLimited"
               ]
             ]
           }

packages/@aws-cdk/aws-codedeploy/test/lambda/test.deployment-group.ts

@@ -101,7 +101,7 @@ export = {
               [
                 'arn:',
                 { Ref: 'AWS::Partition' },
-                ':iam::aws:policy/service-role/AWSCodeDeployRoleForLambda',
+                ':iam::aws:policy/service-role/AWSCodeDeployRoleForLambdaLimited',
               ],
             ],
           },
@@ -160,7 +160,7 @@ export = {
               [
                 'arn:',
                 { Ref: 'AWS::Partition' },
-                ':iam::aws:policy/service-role/AWSCodeDeployRoleForLambda',
+                ':iam::aws:policy/service-role/AWSCodeDeployRoleForLambdaLimited',
               ],
             ],
           },