title: sls deploying multiple IAM roles for lambda, which assumes wrong role with missing permissions
body: <p>i'm currently running a sls project that has 2 lambda functions. One pushes an item to dynamo, the other is triggered when an item is pushed to dynamo (stream). "Process lambda" -> DDB -> "Build lambda".</p>
  
  <p>When testing locally with sls all the PutItem calls work. When <code>sls deploy</code> and testing live on aws, i get access denied issue:</p>
  
  <pre><code>assumed-role/app-client-onboarder-dev-us-east-2-lambdaRole/app-client-onboarder-dev-app_new_client_process is not authorized to perform: dynamodb:PutItem on resource: arn:aws:dynamodb:us-east-2:123456789:table/dev-app-clients 
  </code></pre>
  
  <p>When i look into IAM, are 2 roles for this deployment (which i thought there'd be only 1)</p>
  
  <ol>
  <li>arn:aws:iam::123456789:role/AppClient-dev-BuildProcessLambdaExecutionRole</li>
  <li>arn:aws:iam::123456789:role/app-client-onboarder-dev-us-east-2-lambdaRole</li>
  </ol>
  
  <p>It looks like the assumed role above is <code>assumed-role/role 1./role 2.</code></p>
  
  <ul>
  <li>The first one is defined in resources (see at bottom) with the seperated policies</li>
  <li>The second one looks to be built for this cf/sls deployment - this one has a single policy with multiple statements, is missing key permissions (like dynamodb:PutItem).</li>
  </ul>
  
  <p><strong>What am I missing w/r/t new Roles and policies with sls, having the deployed lambdas assume the defined roles? Where does this second 'deployment' level role come from?</strong></p>
  
  <p>exerpt of <code>serverless.yml</code> is found below.</p>
  
  <pre><code>service: app-client-onboarder
  
  
  provider:
    name: aws
    runtime: nodejs12.x
    region: us-east-2
    stage: dev
  
  functions:
    app_new_client_process:
      handler: lambda/handler.app_new_client_process
      tracing: true
      environment:
        DynamoClientTableName: ${self:custom.client-table-name.${self:provider.stage}}
        DynamoDataTableNamePrefix: ${self:custom.client-data-table-name-prefix.${self:provider.stage}}
  
    app_new_client_build_resources:
      handler: lambda/handler.app_new_client_build_resources
      tracing: true
      events:
        - stream: ${self:custom.client-table-updates.${self:provider.stage}}
      environment:
        DynamoClientTableName: ${self:custom.client-table-name.${self:provider.stage}}
        DynamoDataTableNamePrefix: ${self:custom.client-data-table-name-prefix.${self:provider.stage}}
  
  
  resources:
    Resources: 
      appClientBuildProcessLambdaExecutionRole:
        Type: AWS::IAM::Role
        Properties:
          RoleName: appClient-${self:provider.stage}-BuildProcessLambdaExecutionRole
          AssumeRolePolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Principal:
                  Service:
                    - lambda.amazonaws.com
                Action: sts:AssumeRole
          Policies:
          - PolicyName: appClientDynamoDBIamPolicy
            PolicyDocument: 
              Version: '2012-10-17'
              Statement:
                - Effect: "Allow"
                  Action:
                    - "dynamodb:DescribeTable"
                    - "dynamodb:GetItem"
                    - "dynamodb:PutItem"
                    - "dynamodb:DescribeStream"
                    - "dynamodb:ListStreams"
                    - "dynamodb:ListTables"
                  Resource: "arn:aws:dynamodb:*:146449424444:table/*app-client*"
          - PolicyName: appLogsIamPolicy
            PolicyDocument: 
              Version: '2012-10-17'
              Statement:
                - Effect: "Allow"
                  Action:
                    - "logs:CreateLogGroup"
                    - "logs:CreateLogStream"
                    - "logs:PutLogEvents"
                  Resource: "arn:aws:logs:*:146449424444:*"
          - PolicyName: appXrayTracingPolicy
            PolicyDocument: 
              Version: '2012-10-17'
              Statement:
                - Effect: "Allow"
                  Action:
                    - "xray:PutTraceSegments"
                    - "xray:PutTelemetryRecords"
                  Resource: "*"
  
  plugins: 
    - serverless-plugin-tracing
  </code></pre>