Hey all! I was playing around with some examples from the docs, in particular the

onObjectCreated

magic function, but Im curious about the permission structure here.

import * as aws from "@pulumi/aws";

const docsBucket = new aws.s3.Bucket("docs");

docsBucket.onObjectCreated("docsHandler", (event: aws.s3.BucketEvent) => {
  console.log("WOW A FILE WAS CREATED!");
});

This will result in role policy attachments that give Full Access to cloudwatch, lambda, dynamo, and more. Is that intended or am I missing something?