What and why?

This PR adds a new lambda cloudwatch command to the Lambda plugin that accepts enable or disable as an action. This allows users to disable CloudWatch Logs for Lambda functions by attaching a deny IAM policy, and re-enable them by removing that policy. This provides a way to control CloudWatch logging costs while maintaining Lambda function operation.

How?

• Added a unified LambdaCloudwatchCommand that takes an action parameter (enable or disable)
• Implemented the corresponding plugin command that handles AWS interactions
• Created CloudWatch-specific functions for managing IAM policies
• Added a renderer for CloudWatch-related output
• Added comprehensive tests for the command
• Updated the CLI command registry to include the new command

Testing

Note, for all commands below, alias:

alias aws-sso='aws-vault exec sso-serverless-sandbox-account-admin -- '

Dry run:

aws-sso yarn launch lambda cloudwatch disable --dry-run -f <function-arn>
aws-sso yarn launch lambda cloudwatch enable --dry-run -f <function-arn>

Live test:

aws-sso yarn launch lambda cloudwatch disable -f <function-arn>
# Verify it gets added:
aws-sso aws iam get-role-policy --role-name <role-from-output> --policy-name DenyCloudWatchLogs

aws-sso yarn launch lambda cloudwatch enable -f <function-arn>
# Verify: above command should now return NoSuchEntity

# Multi-function & regex
aws-sso yarn launch lambda cloudwatch disable --dry-run --functions-regex 'my-prefix' -r us-east-1
aws-sso yarn launch lambda cloudwatch disable --dry-run -f <arn1> -f <arn2>

Example notebook

Review checklist

• Feature or bugfix MUST have appropriate tests (unit, integration)