Example: Lambda function reading S3 bucket

# CORRECT: Define resource permission in Terraform as IAM role
resource "aws_iam_role" "lambda_role" {
  name = "my-function-role"
  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Action = "sts:AssumeRole"
      Effect = "Allow"
      Principal = {
        Service = "lambda.amazonaws.com"
      }
    }]
  })
}

resource "aws_iam_role_policy" "lambda_s3_access" {
  role = aws_iam_role.lambda_role.id
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect = "Allow"
      Action = ["s3:GetObject", "s3:PutObject"]
      Resource = "arn:aws:s3:::my-bucket/*"
    }]
  })
}

resource "aws_lambda_function" "my_function" {
  function_name = "my-function"
  role = aws_iam_role.lambda_role.arn
  # ...
}

Example: API Gateway invoking Lambda

# CORRECT: Define resource permission in Terraform as resource policy
resource "aws_lambda_permission" "apigw_lambda" {
  statement_id  = "AllowAPIGatewayInvoke"
  action        = "lambda:InvokeFunction"
  function_name = aws_lambda_function.my_function.function_name
  principal     = "apigateway.amazonaws.com"
  source_arn    = "${aws_api_gateway_rest_api.api.execution_arn}/*/*"
}

Response to user: "This is a resource permission (runtime behavior), not a deploy permission. Please define it in Terraform using the pattern above. Resource permissions should be managed as IAM roles/policies attached to resources, not as deploy user permissions."