fix: Don't add policies to pre-created roles in the stack

Author: clareliguori

e2e_tests/setup/integ-test-authentication.yaml

@@ -142,6 +142,7 @@ Resources:
               - "secretsmanager:*"
             Resource:
               - !Sub "arn:aws:secretsmanager:${AWS::Region}:${AWS::AccountId}:secret:bedrock-agentcore-identity*"
+              - !Sub "arn:aws:secretsmanager:${AWS::Region}:${AWS::AccountId}:secret:Zen*"
           - Effect: Allow
             Action:
               - "s3:GetObject"

examples/servers/dog-facts/lib/dog-facts-mcp-server.ts

@@ -94,9 +94,6 @@ export class DogFactsMcpServer extends cdk.Stack {
       },
     });
 
-    // Grant the Lambda function permission to read the secret
-    apiKeySecret.grantRead(lambdaFunction);
-
     // Create API Gateway for OAuth-based access
     this.createApiGateway(lambdaFunction, stackNameSuffix);
   }