Bug fixes

• The AWS > Turbot > Service Roles stack now attaches the default AWS Config policy — the AWS managed AWS_ConfigRole policy — to the Guardrails-managed Configuration Recorder service role (turbot_config). As of July 31, 2026, AWS requires the recorder role to hold explicit read permissions such as lambda:ListTags to record resource configurations and tags; without them, AWS Config no longer records AWS Lambda function tags. Attaching the AWS-maintained default policy keeps recording working for all supported resource types and automatically picks up any future permission requirements.