Another question...this one related to pulumi cloud - it looks as though it infers relationships between resources through usage eg, if you reference a table in a lambda I suppose it will go ahead and create all the necessary IAM permissions for the lambda to get data from it. If you are running a Task, and the task needs access to a pulumi "Table" is there any way to explicitly define that (because the Task code is opaque it would not be possible for pulumi to infer it). Or do you have to fallback to the provider level / aws and link it all up yourself?