[tim-thacker-nullify]

Customer connector roles omit the configuration-only Lambda read used by the cloud credential scanner.

• Add only lambda:GetFunctionConfiguration to the existing read policy in CloudFormation and both Terraform variants; preserve trust, resources, conditions, denies and existing permissions.
• Require that exact grant in the existing policy-drift gate, so three equally incomplete templates cannot pass parity.
• Exercise actual policies plus missing, wildcard, scoped, wrong-effect and explicit-deny counterfactuals through the existing CI test command.
• The new contract fails on unchanged policies and passes after the three action additions; policy parity, eight Python tests, Terraform formatting and JSON validation pass.
• Supports Nullify-Platform/nullify#17005. Customer role updates and live IAM acceptance remain required before scanner activation; this PR changes no deployed role.
• Correctness confidence: 90% engineering estimate; exact source contracts pass, while all 33 hosted Terraform/CloudFormation jobs pass; live AWS behavior remains unverified.
• Merge risk: low; one read action in three policies plus bounded contract checks. Deployment risk: moderate; customer-applied role changes and scanner rollout require separate validation.

[tim-thacker-nullify]

Bounded review at 495cd99f441:

• All three customer role policies add exactly lambda:GetFunctionConfiguration; trust, deny statements, resources, conditions and existing actions are unchanged.
• The new policy contract rejects the unchanged templates even though their parity check agrees. Actual policies and missing/wildcard/scoped/wrong-effect/deny counterfactuals pass through the existing CI commands.
• All 33 hosted Terraform/CloudFormation jobs pass, including policy drift, mocked Terraform plans and cfn-lint. This is source validation, not a live IAM simulation or customer role update.
• Correctness confidence: 90% engineering estimate. Merge risk: low; one read action plus contract checks. Deployment risk: moderate; customer role application and scanner activation remain separate requirements.
• Supports Nullify-Platform/nullify#17005. dnjg is requested once; no merge, role update or deployment occurred.