Have an ability to set iam role tags

Use case description

Sometimes there are use cases when it’s needed for lambda execution role to have special tags (same as function.tags). Those can be used for attribution, access control or something else.

Currently there’re at least two ways to have those:

• Use top level stackTags which will be “cascaded” to all application resources. Cons: all resources will get the tag, while it’s only intended for the execution role.
• Use custom role. Cons: boilerplate code, additional complexity for the user.

Proposed solution

Add iamRoleTags directive with standard key-value format like so:

iamRoleTags:
  reader: 'restricted'
  foo: 'bar'

iamRoleStatements: 
  - Effect: Allow
    Action:
      - s3:GetObject
    Resource:
      - arn:aws:s3:::sensitive-data

I’m happy to craft a PR for this change as long as this proposal gets endorsement from the maintainers.

[medikoo]

whenever I see two properties that would apply to the same resource, it suggests that it might be worth considering if it wouldn’t be better to gather them under a common property e.g.

+1. It indeed again puts us on path of introducing new deprecation, but I think it’s good idea to group it. We also have other IAM related properties. I’d group them all under provider.iam as below:

provider:
  iam:
    role: # either a directly assigned ARN or object with below options
      permissionBoundary: ...
      managedPolicies: ...
      statements: ...
      tags: ...
    deploymentRole: ... # Replacement for `cfnRole`

In that case I’d split this work into two independent tasks. First that moves us to new configuration, and second that follows with introduction of provider.iam.role.tags

[runk]

Any objections if I draft a PR with the first task around grouping the iam-related props?