Rico Hermans

My vote would be to disable it by default, and make it an opt-in for people who prefer the current behavior. If the goal is to take away manual labour...

Sounds useful. Would accept a PR to this effect.

Hi @siqusoft, your issue seems unrelated to the OP. Please open a new bug report for that.

As for the original report: reasonable ask, although one that will probably have to be contributed.

The solution for this will be to generate a policy that looks like: ``` Resource: [ 'arn:aws:lambda:....:MyFunction', 'arn:aws:lambda:....:MyFunction:*', ] ``` It will go well with a change Lambda is about...

We can certainly add that to the documentation.

I assume it would have to go into all `AssumeRolePolicyDocument`s in this file: https://github.com/aws/aws-cdk/blob/master/packages/aws-cdk/lib/api/bootstrap/bootstrap-template.yaml#L215

I would need to see the dependency structure here to see where we can add a dependency line most conveniently without introducing a cycle. I'm guessing right now `internetConnectivityEstablished` results...

I believe it's this. * For public subnets (and public subnets only), `internetConnectivityEstablished` contains the IGW, which is actually unnecessary (the dependency is transitively implied by the dependency on the...

This might be true. It probably wouldn't be too hard to add support for this, although it might get complex for other languages as we don't necessarily know the CDK...