feat: add AssumeRolePolicyDocument to AWS::Serverless::Function

[timoschilling]

Issue #, if available:
To use a AWS::Serverless::Function as lambda@edge you need to add an explicit policy to allow CloudFront to execute the function.

Description of changes:
With this change you can define a AssumeRolePolicyDocument on the SAM created role.

Before:

  Function:
    Type: AWS::Serverless::Function
    Properties:
      Handler: index.handler
      Runtime: nodejs8.10
      Timeout: 30
      AutoPublishAlias: true
      Role: !GetAtt Role.Arn

  Role:
    Type: AWS::IAM::Role
    Properties:
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
                - edgelambda.amazonaws.com
            Action: sts:AssumeRole
      Path: /
      Policies:
        - PolicyName: InvokeLambda
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action: s3:*
                Resource: ...

After:

  Function:
    Type: AWS::Serverless::Function
    Properties:
      Handler: index.handler
      Runtime: nodejs8.10
      Timeout: 30
      AutoPublishAlias: true
      Policy:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action: s3:*
            Resource: ...
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
                - edgelambda.amazonaws.com
            Action: sts:AssumeRole

Description of how you validated changes:

Checklist:

• Write/update tests
• make pr passes
• Update documentation
• Verify transformed template deploys and application functions as expected
• Add/update example to examples/2016-10-31

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[codecov-io]

Codecov Report

Merging #1311 into develop will decrease coverage by 0.02%.
The diff coverage is 100%.

@@             Coverage Diff             @@
##           develop    #1311      +/-   ##
===========================================
- Coverage    94.44%   94.41%   -0.03%     
===========================================
  Files           78       78              
  Lines         4353     4388      +35     
  Branches       860      871      +11     
===========================================
+ Hits          4111     4143      +32     
- Misses         115      116       +1     
- Partials       127      129       +2

Impacted Files	Coverage Δ
samtranslator/plugins/globals/globals.py	99.05% <ø> (ø)	⬆️
samtranslator/model/sam_resources.py	95.12% <100%> (+0.02%)	⬆️
samtranslator/model/api/api_generator.py	95.13% <0%> (-0.09%)	⬇️
samtranslator/model/eventsources/push.py	90.53% <0%> (-0.04%)	⬇️

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update a062026...d7f8589. Read the comment docs.

[timoschilling]

@praneetap @ShreyaGangishetty any updates on this PR?

[ShreyaGangishetty]

@timoschilling Thank you for your contribution! This PR looks good to me

[jplock]

With this change, does the Lambda@Edge function still have access to write to CloudWatch logs, which previously was part of arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole?

[jplock]

Is AssumeRolePolicyDocument supported in Globals? Based on the code changes, it looks like it should, but when trying to publish I'm getting:

Publish Failed
Error: Invalid Serverless Application Specification document. Number of errors found: 1. Errors: 'Globals' section is invalid. 'AssumeRolePolicyDocument' is not a supported property of 'Function'. Must be one of the following values - ['Handler', 'Runtime', 'CodeUri', 'DeadLetterQueue', 'Description', 'MemorySize', 'Timeout', 'VpcConfig', 'Environment', 'Tags', 'Tracing', 'KmsKeyArn', 'AutoPublishAlias', 'Layers', 'DeploymentPreference', 'PermissionsBoundary', 'ReservedConcurrentExecutions', 'ProvisionedConcurrencyConfig']
Please follow the instructions in https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/serverless-sam-template-publishing-applications.html