fix: Improve Error/Diag handling for nested resources (#1214)

#### Summary

- Panic When No lambda:Get* permissions
- Don't return early if IoT:DescribeStream ends early


---

client/helpers.go

@@ -89,6 +89,7 @@ var accessDeniedErrorStrings = map[string]struct{}{
 	"AccessDeniedException":           {},
 	"InsufficientPrivilegesException": {},
 	"UnauthorizedOperation":           {},
+	"Unauthorized":                    {},
 }
 
 func readSupportedServiceRegions() *SupportedServiceRegionsData {

resources/services/iot/iot_streams.go

@@ -119,6 +119,7 @@ func IotStreams() *schema.Table {
 // ====================================================================================================================
 
 func fetchIotStreams(ctx context.Context, meta schema.ClientMeta, parent *schema.Resource, res chan<- interface{}) error {
+	var diags diag.Diagnostics
 	input := iot.ListStreamsInput{
 		MaxResults: aws.Int32(250),
 	}
@@ -130,7 +131,7 @@ func fetchIotStreams(ctx context.Context, meta schema.ClientMeta, parent *schema
 			options.Region = c.Region
 		})
 		if err != nil {
-			return diag.WrapError(err)
+			return diags.Add(diag.FromError(diag.WrapError(err), diag.RESOLVING, diag.WithSeverity(diag.ERROR)))
 		}
 		for _, s := range response.Streams {
 			stream, err := svc.DescribeStream(ctx, &iot.DescribeStreamInput{
@@ -139,7 +140,9 @@ func fetchIotStreams(ctx context.Context, meta schema.ClientMeta, parent *schema
 				options.Region = c.Region
 			})
 			if err != nil {
-				return diag.WrapError(err)
+				// A single `Describe` call error should not end resolving of table
+				diags = diags.Add(diag.FromError(err, diag.RESOLVING, diag.WithSeverity(diag.WARNING)))
+				continue
 			}
 			res <- stream.StreamInfo
 		}
@@ -148,7 +151,7 @@ func fetchIotStreams(ctx context.Context, meta schema.ClientMeta, parent *schema
 		}
 		input.NextToken = response.NextToken
 	}
-	return nil
+	return diags
 }
 func fetchIotStreamFiles(ctx context.Context, meta schema.ClientMeta, parent *schema.Resource, res chan<- interface{}) error {
 	i := parent.Item.(*types.StreamInfo)

resources/services/lambda/functions.go

@@ -1098,7 +1098,7 @@ func fetchLambdaFunctions(ctx context.Context, meta schema.ClientMeta, parent *s
 			options.Region = c.Region
 		})
 		if err != nil {
-			return diag.WrapError(err)
+			return diags.Add(diag.FromError(diag.WrapError(err), diag.RESOLVING, diag.WithSeverity(diag.ERROR)))
 		}
 
 		for _, f := range response.Functions {
@@ -1165,8 +1165,9 @@ func resolvePolicyCodeSigningConfig(ctx context.Context, meta schema.ClientMeta,
 	}
 
 	// skip getting CodeSigningConfig since containerized lambda functions does not support this feature
-	lambdaType := resource.Get("code_repository_type").(*string)
-	if *lambdaType == "ECR" {
+	// value can be nil if the caller doesn't have GetFunctionConfiguration permission and only has List*
+	lambdaType, ok := resource.Get("code_repository_type").(*string)
+	if !ok || *lambdaType == "ECR" {
 		return nil
 	}