[docs]: callback and read APIs authorize roles

[yaythomas]

URL/Location

No response

Describe What's Incorrect or Lacking

---

Proposed change 1: fix SDK docs testing/cloud-runner.md

The "Required IAM permissions" example uses the bare function ARN as Resource
for lambda:GetDurableExecution and lambda:GetDurableExecutionHistory.
Verified broken (row 1 of the matrix). Change:

"Resource": "arn:aws:lambda:region:account-id:function:function-name"

to:

"Resource": "arn:aws:lambda:region:account-id:function:function-name:*"

Pending verification: whether lambda:InvokeFunction in the same example also
needs the qualified form for function-name:$LATEST invokes.

Proposed change 2 (optional): pointer from SDK docs callback page

Add one line to the "Send callback results" section of
sdk-reference/operations/callback.md: "The calling principal needs permission to
send callbacks for the durable execution. See [Security and permissions for
Lambda durable functions] in the AWS Lambda Developer Guide."

Keeps the SDK
docs/dev guide split intact (permissions content stays in the dev guide).

Suggested Improvement

No response

Additional Context

No response