Or should I do something like this

const role = new Role('role')
const policy = new Policy('policy', {})
const rpa = new RolePolicyAttachment('rpa', { role, policy })
const myLambda = new Lambda('lambda', { executionRole: role }, { dependsOn: [rpa] })

You'll need to do this.

Great, thanks for confirming

Yes, though the explicit dependency is good for self-documentation purposes. And would there be cases where Pulumi would guess incorrectly? For example, if there were multiple RolePolicyAttachments and only one was relevant to the lambda?

Possible. Thoughts on this pattern?

const executionRole = new LambdaExecutionRole()

new Lambda('', { role: executionRole.role }, { dependsOn: [executionRole] }))

executionRole.attachPolicy(...)

This would create a role policy attachment with parent of the LambdaExecutionRole. Allowing role policy attachments to be added after the lambda has been `new`ed up, but also creating a dependency between the RPA’s and hte lambda?