s3-notifications: add option to skip permissions for LambdaDestination

[dirkluijk]

Describe the feature

Similar to the LambdaDestination in aws-logs-destinations:

aws-cdk/packages/aws-cdk-lib/aws-logs-destinations/lib/lambda.ts

Line 13 in 47a3ee3

readonly addPermissions?: boolean;

I would like to have the same option in the LambdaDestination in aws-s3-notifications.

This feature request is similar to #14198

Use Case

We have an shared Lambda function (acting as a forwarder) that already has all appropriate permissions, and we don't want anyone to be able to change those permissions.

Proposed Solution

Add an additional option addPermissions?: boolean

Other Information

No response

Acknowledgements

• I may be able to implement this feature request
• This feature might incur a breaking change

AWS CDK Library version (aws-cdk-lib)

2.201.0

AWS CDK CLI version

2.1018.1

Environment details (OS name and version, etc.)

macOS

[pahud]

Hi @dirkluijk,

Thank you for submitting this feature request! This is a valid enhancement that would bring consistency between the S3 notifications and CloudWatch Logs destinations implementations.

The LambdaDestination class in S3 notifications could indeed benefit from having the same addPermissions option that exists in the Logs destinations module.

This would be particularly useful in your use case where permissions are managed separately, and it would provide better control over IAM permission creation.

Since you've indicated you might be able to implement this feature, here's what would need to be done:

1. Add a LambdaDestinationOptions interface with the addPermissions?: boolean property
2. Update the LambdaDestination constructor to accept these options
3. Modify the bind() method to make permission creation conditional

This should be a non-breaking change since the default behavior would remain the same (creating permissions by default).

Thank you for the contributions!

[dirkluijk]

I already implemented it in #34749 ;)

Added the issue to track it.