code: func eventSourceMappingPoliciesForResource(resource *resourceRef,
  	template *gocf.Template,
  	logger *logrus.Logger) ([]spartaIAM.PolicyStatement, error) {
  
  	policyStatements := []spartaIAM.PolicyStatement{}
  
  	if isResolvedResourceType(resource, template, ":dynamodb:", &gocf.DynamoDBTable{}) {
  		policyStatements = append(policyStatements, CommonIAMStatements.DynamoDB...)
  	} else if isResolvedResourceType(resource, template, ":kinesis:", &gocf.KinesisStream{}) {
  		policyStatements = append(policyStatements, CommonIAMStatements.Kinesis...)
  	} else if isResolvedResourceType(resource, template, ":sqs:", &gocf.SQSQueue{}) {
  		policyStatements = append(policyStatements, CommonIAMStatements.SQS...)
  	} else {
  		logger.WithFields(logrus.Fields{
  			"Resource": resource,
  		}).Debug("No additional EventSource IAM permissions found for event type")
  	}
  	return policyStatements, nil
  }
docs: // eventSourceMappingPoliciesForResource returns the IAM specific privileges for each
  // type of supported AWS Lambda EventSourceMapping