### Is there an existing issue for this?

- [X] I have searched the existing issues

### Feature description

Basically we want to only run the lambda when an insert is occurring in DynamoDB.
I tested using Dynobase deleting a record and the lambda still triggered.

```
resource "aws_lambda_event_source_mapping" "event-log" {
	event_source_arn  = aws_dynamodb_table.event-log.stream_arn
	function_name     = module.main.lambda-arn
	starting_position = "LATEST"
	enabled = true # change to false when truncating the table in localstack
	maximum_retry_attempts = 1 # limit retry on failure to 1 for now

	# https://dev.to/aws-builders/filtering-dynamodb-streams-before-lambda-p5p
	filter_criteria { # Doesn't seem to work on LocalStack for now
		filter {
			pattern = jsonencode({
				body = {
					eventName : ["INSERT"]
				}
			})
		}
	}
}
```


### 🧑‍💻 Implementation

_No response_

### Anything else?

 https://dev.to/aws-builders/filtering-dynamodb-streams-before-lambda-p5p
"Action": action,
        "Resource": arn,
    }
    
    if sourcearn:
        condition = {"ArnLike": {"AWS:SourceArn": sourcearn}}
        statement["Condition"] = condition
    
    if principal:
        principal = "*" if principal == "*" else {"Service": principal}
        statement["Principal"] = principal
    if url_auth_type:
        statement["Condition"] = {"StringEquals": {"lambda:FunctionUrlAuthType": url_auth_type}}
    return statement
def generate_policy(sid, action, arn, sourcearn, principal, url_auth_type):
    new_statement = generate_policy_statement(sid, action, arn, sourcearn, principal, url_auth_type)
    policy = {
        "Version": IAM_POLICY_VERSION,
        "Id": "LambdaFuncAccess-%s" % sid,
        "Statement": [new_statement],
    }
    return policy
@app.route("%s/functions/<function>/policy" % API_PATH_ROOT, methods=["POST"])
def add_permission(function):
    arn = func_arn(function)
    qualifier = request.args.get("Qualifier")
    q_arn = func_qualifier(function, qualifier)
    result = add_permission_policy_statement(function, arn, q_arn, qualifier=qualifier)
    return result, 201
def correct_error_response_for_url_config(response):