Feature request: DeploymentPreference created role permissions issues

[royassis]

Describe your idea/feature/enhancement

When creating a lambda with DeploymentPreference, aws SAM creates a CodeDeploy deployment.
There is an option in the SAM template to specify a role for the DeploymentPreference, if none is specified one is automatically created by SAM.

The role that is created by SAM has a single policy, AWSCodeDeployRoleForLambda. The policy has permission to invoke
any lambda with the pattern CodeDeployHook_*, however the default lambda name set for a lambda begins with the stack name, and does not match the mentioned pattern, so the deployments will always fail.

My perception was that the code should be working as is without any changes so I was confused, and wondering what was I doing wrong, it was setting me off-course from resolving the issue.

Proposal

I would suggest adding another permission to the role with the name of the lambda being executed, or adding a clear mention
of this.

[jfuss]

@royassis Will move this to the correct repo. aws/aws-sam-cli is focused on the SAM CLI while aws/serverless-application-model is focused on the Spec/Translation logic.

This might be a duplicate of #250.

At the very least, you can always explicitly name the Lambda Function by providing the (FunctionName)[https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/sam-resource-function.html#sam-function-functionname] Property. Which is needed in this case to scope the name to the managed policy.

[aaythapa]

Thank you for submitting this feature request! There are some viable suggestions in #250 (comment) that we could do but may have some backwards compatibility implications. Need to look deeper into it. For now the workaround would be to explicitly provide the FunctionName property.