Issue came up when we need to add "edgelambda.amazonaws.com" to existing lambda role's trust policy ( which already contains "lambda.amazonaws.com" as a principal ) it's required for all lambda edge features.
https://registry.terraform.io/providers/Cox-Automotive/alks/latest/docs/resources/alks_iamrole
per doc Specifying a custom trust policy like this is currently only supported for single-service trust policies trusting an approved AWS service,