Right now, we only grant permissions on specific versions of an asset. That means that if we publish a new version, the Lambda or CodeBuild role using the assets immediately loses permissions to all previous versions of the asset, causing them to fail.

This is inconvenient for CodeBuilds, but will prevent gradual Lambda deployments for example.

We should probably name the asset something like

$BUCKET/assets/$ID/abcdef12345.zip

And give permissions on the $ID prefix, so that all versions are accepted.