Hei guys, I’m trying to set a policy for a lambda to run post user confirmation in cognito and I want to give it permissions to just be able to PUT in a usersTable but I get this error My code:

const confirmUserIamRolePolicy = new aws.iam.Policy(
  'confirm-user-signup-role-policy',
  {
    policy: JSON.stringify({
      Version: '2012-10-17',
      Statement: [
        {
          Effect: 'Allow',
          Action: [DBAction.Put],
          Resource: usersTable.arn.apply((arn) => `${arn}`),
        },
      ],
    }),
  }
)

export const confirmUserIamRole = new aws.iam.Role('confirm-user-signup-role', {
  assumeRolePolicy: aws.iam.assumeRolePolicyForPrincipal({
    Service: '<http://lambda.amazonaws.com|lambda.amazonaws.com>',
  }),
  managedPolicyArns: [confirmUserIamRolePolicy.arn],
})

const confirmUserIamRolePolicyAttachment = new aws.iam.PolicyAttachment(
  'confirm-user-signup-role-policy-attachment',
  {
    policyArn: confirmUserIamRolePolicy.arn,
    roles: [confirmUserIamRole],
  }
)

export const postConfirmationLambda = new aws.lambda.CallbackFunction(
  'post-confirmation-signup-lambda',
  {
    runtime: 'nodejs14.x',
    callback: confirmUserSignupHandler,
    role: confirmUserIamRole,
    environment: {
      variables: {
        USERS_TABLE: usersTable.name,
        REGION: region,
      },
    },
  }
)

Your output isn't applied which results in a malformed JSON document

Perfect! Thank you very much!