Amplify SSR Lambda@Edge dynamodb permissions

**Please describe which feature you have a question about?**
SSR (next.js) with Amplify and Dynamodb

**Provide additional details**

I am deploying a Next.js app to Amplify with the amplify-cli. I've connected my amplify app to a couple of existing DynamoDB tables. I've managed to modify the attached amplify app's Service role adding in the `AmazonDynamoDBFullAccess` permission policy (I'll restrict it down later). This seems to work with no complains on direct hits to backend routes that use the dynamodb.

However, the deployed SSR lambdas are still getting permission errors coming up in the logs for the "SSR Lambda@Edge".

```
arn:aws:sts::999999999:assumed-role/rgsuvm9-psuzoeg/us-east-1.ggvvff-abc123 is not authorized to perform: dynamodb:Scan on resource: arn:aws:dynamodb:eu-west-2:6666666666:table/MyTable
````

I noticed these roles that have been automatically created with generated names for `AWS Service: lambda` trusted entitees that have policies attached for **allowing access to logs and S3 only**.

[![list of generated edge lambda roles][1]][1]

[1]: https://i.stack.imgur.com/RxU8E.png

Here is an example of one of the attached permission policies for these generated roles (this is before I have manually edited it to add dynamodb access permission):

```json

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Resource": "*",
"Action": [
"logs:CreateLogGroup",
"logs:CreateLogStream",
"logs:PutLogEvents"
]
},
{
"Effect": "Allow",
"Resource": "arn:aws:s3:::z0kq2lk-i0l0usx/*",
"Action": [
"s3:GetObject",
"s3:PutObject"
]
}
]
}
```

**Manually selecting one of these and adding dynamodb read/write permissions fixes the problem and the SSR edge lambda seems to have the correct permissions to connect to the dynamodb - great, but this isn't a nice way to do it**

My question is: How to change the permissions of the SSR Lambda? It's not a feasible or a good solution for me to manually add these permissions to this role that's clearly generated.

It seems odd to me that it doesn't use the service role that's assigned in the amplify app's general settings. Could that be a problem with amplify - or have I misconfigured the service role? (my service role used uses the `AdministratorAccess-Amplify` and `AmazonDynamoDBFullAccess` policies so to my mind there's no point pasting these in).

Kind Thanks in Advance,
Colin

Start with the deployed SSR Lambda@Edge role and its generated IAM policy, then compare it with the Amplify app service role described in the issue. Trace how permissions for connected DynamoDB tables are assigned during deployment; done means the SSR Lambda can access the table without manually editing generated roles.

Written by the indexing model from the issue text.