chore(network-connector): switch OperatorRole to managed policy and fill sam-docs descriptions

integration/single/test_basic_network_connector.py

@@ -48,12 +48,13 @@ def test_basic_network_connector(self):
                 principals.extend(service)
         self.assertIn("lambda.amazonaws.com", principals)
 
-        # Verify inline policy
-        role_policy = iam_client.get_role_policy(RoleName=role_name, PolicyName="NetworkConnectorOperatorPolicy")
-        statements = role_policy["PolicyDocument"]["Statement"]
-        all_actions = [s["Action"] for s in statements]
-        self.assertIn("ec2:CreateNetworkInterface", all_actions)
-        self.assertIn("ec2:CreateTags", all_actions)
+        # Verify managed policy
+        attached = iam_client.list_attached_role_policies(RoleName=role_name)
+        policy_arns = [p["PolicyArn"] for p in attached["AttachedPolicies"]]
+        self.assertTrue(
+            any("AWSLambdaNetworkConnectorOperatorPolicy" in arn for arn in policy_arns),
+            "OperatorRole should have AWSLambdaNetworkConnectorOperatorPolicy attached",
+        )
 
     def test_network_connector_with_custom_role(self):
         """

samtranslator/model/network_connector/generators.py

@@ -5,10 +5,13 @@
 from typing import Any
 
 from samtranslator.model import Resource
-from samtranslator.model.iam import IAMRole, IAMRolePolicies
+from samtranslator.model.iam import IAMRolePolicies
 from samtranslator.model.intrinsics import fnGetAtt
 from samtranslator.model.network_connector.resources import LambdaNetworkConnector
+from samtranslator.model.resource_policies import ResourcePolicies
+from samtranslator.model.role_utils import construct_role_for_resource
 from samtranslator.model.tags.resource_tagging import get_tag_list
+from samtranslator.translator.arn_generator import ArnGenerator
 
 
 class NetworkConnectorGenerator:
@@ -72,65 +75,30 @@ def _create_network_connector(self) -> LambdaNetworkConnector:
 
         return connector
 
-    def _create_operator_role(self) -> IAMRole:
+    def _create_operator_role(self) -> Resource:
         role_logical_id = f"{self.logical_id}OperatorRole"
 
-        assume_role_policy = IAMRolePolicies.construct_assume_role_policy_for_service_principal("lambda.amazonaws.com")
-
-        role = IAMRole(role_logical_id, attributes=self.passthrough_resource_attributes)
-        role.AssumeRolePolicyDocument = assume_role_policy
-        role.Policies = [
-            {
-                "PolicyName": "NetworkConnectorOperatorPolicy",
-                "PolicyDocument": {
-                    "Version": "2012-10-17",
-                    "Statement": [
-                        {
-                            "Sid": "AllowCreateEniInAnySubnet",
-                            "Effect": "Allow",
-                            "Action": "ec2:CreateNetworkInterface",
-                            "Resource": {"Fn::Sub": "arn:${AWS::Partition}:ec2:*:*:subnet/*"},
-                        },
-                        {
-                            "Sid": "AllowCreateEniWithSecurityGroups",
-                            "Effect": "Allow",
-                            "Action": "ec2:CreateNetworkInterface",
-                            "Resource": {"Fn::Sub": "arn:${AWS::Partition}:ec2:*:*:security-group/*"},
-                        },
-                        {
-                            "Sid": "AllowCreateEniWithLambdaTagKeys",
-                            "Effect": "Allow",
-                            "Action": "ec2:CreateNetworkInterface",
-                            "Resource": {"Fn::Sub": "arn:${AWS::Partition}:ec2:*:*:network-interface/*"},
-                            "Condition": {
-                                "ForAllValues:StringEquals": {
-                                    "aws:TagKeys": [
-                                        "aws:lambda:networkConnectorName",
-                                        "aws:lambda:networkConnectorId",
-                                    ]
-                                }
-                            },
-                        },
-                        {
-                            "Sid": "TagENIOnCreate",
-                            "Effect": "Allow",
-                            "Action": "ec2:CreateTags",
-                            "Resource": {"Fn::Sub": "arn:${AWS::Partition}:ec2:*:*:network-interface/*"},
-                            "Condition": {
-                                "StringEquals": {
-                                    "ec2:CreateAction": "CreateNetworkInterface",
-                                    "ec2:ManagedResourceOperator": "network-connectors.lambda.amazonaws.com",
-                                }
-                            },
-                        },
-                    ],
-                },
-            }
-        ]
+        assume_role_policy_document = IAMRolePolicies.construct_assume_role_policy_for_service_principal(
+            "lambda.amazonaws.com"
+        )
+
+        tags = self._transform_tags()
+
+        managed_policy_arns = [ArnGenerator.generate_aws_managed_policy_arn("AWSLambdaNetworkConnectorOperatorPolicy")]
+
+        operator_role = construct_role_for_resource(
+            resource_logical_id=self.logical_id,
+            attributes=self.passthrough_resource_attributes,
+            managed_policy_map=None,
+            assume_role_policy_document=assume_role_policy_document,
+            resource_policies=ResourcePolicies({}),
+            managed_policy_arns=managed_policy_arns,
+            tags=tags,
+        )
 
-        role.Tags = self._transform_tags()
+        operator_role.logical_id = role_logical_id
 
-        return role
+        return operator_role
 
     def _transform_tags(self, tags: dict[str, Any] | None = None) -> list[dict[str, str]]:
         tags_dict = (tags or {}).copy()