Could use an advice on how to attach an additional role policy to the default policy created for an implicit lambda:

aws.cloudwatch.onSchedule("test", "rate(1 minute)", async (event) => {
    try {
        let secret = await MYSSM.getValue("mySecret");
        console.log(secret);
        console.log(`current time: ${Date.now()}`);
    } catch (e) {
        console.log(e);
    }
});