I’m new to SST, I’m new to this lambda permissions property, that appears to just simply take in the instance of a resource. Is there any docs around this? I’m stumbling around CDK docs too to see if I missed some core functionality?

Here are the different ways you can configure permissions: https://docs.serverless-stack.com/util/Permissions

Thanks @thdxr This is great. what if I need to give a lambda permissions to an “existing” SSM param? Something that is not defined in the CDK code. Unless there is a way to setup an SSM instance based on an existing ssm name?

yeah we should maybe make this easier. Here's what I do, not sure if there's an easier way

new iam.PolicyStatement({
          resources: [
            `arn:aws:ssm:${app.region}:${app.account}:parameter/${app.stage}/*`,
          ],
          actions: ["*"],
          effect: iam.Effect.ALLOW,
        }),

sweet