@Override
    public void before(Context context, ResourceSchema.Builder resourceSchema) {
        if (context.getConfig().getDisableHandlerPermissionGeneration()) {
            return;
        }

        Model model = context.getModel();
        ServiceShape service = context.getService();
        ResourceShape resource = context.getResource();

        // Start the create and update handler permission gathering.
        // TODO Break this out to its own knowledge index if it becomes useful in more contexts.
        Set<String> createPermissions = resource.getCreate()
                .map(operation -> getPermissionsEntriesForOperation(model, service, operation))
                .orElseGet(TreeSet::new);
        Set<String> updatePermissions = resource.getUpdate()
                .map(operation -> getPermissionsEntriesForOperation(model, service, operation))
                .orElseGet(TreeSet::new);

        // Add the permissions from the resource's put lifecycle operation
        // to the relevant handlers.
        Set<String> putPermissions = resource.getPut()
                .map(operation -> getPermissionsEntriesForOperation(model, service, operation))
                .orElse(SetUtils.of());
        createPermissions.addAll(putPermissions);
        // Put operations without the noReplace trait are used for updates.
        if (!resource.hasTrait(NoReplaceTrait.ID)) {
            updatePermissions.addAll(putPermissions);
        }

        // Set the create and update handlers, if they have permissions, now that they're complete.
        if (!createPermissions.isEmpty()) {
            resourceSchema.addHandler("create", Handler.builder().permissions(createPermissions).build());
        }
        if (!updatePermissions.isEmpty()) {
            resourceSchema.addHandler("update", Handler.builder().permissions(updatePermissions).build());
        }

        // Add the handler permission sets that don't need operation
        // permissions to be combined.
        resource.getRead()
                .map(operation -> getPermissionsEntriesForOperation(model, service, operation))
                .ifPresent(permissions -> resourceSchema.addHandler("read",
                        Handler.builder()
                                .permissions(permissions)
                                .build()));

        resource.getDelete()
                .map(operation -> getPermissionsEntriesForOperation(model, service, operation))
                .ifPresent(permissions -> resourceSchema.addHandler("delete",
                        Handler.builder()
                                .permissions(permissions)
                                .build()));

        resource.getList()
                .map(operation -> getPermissionsEntriesForOperation(model, service, operation))
                .ifPresent(permissions -> resourceSchema.addHandler("list",
                        Handler.builder()
                                .permissions(permissions)
                                .build()));
    }
Generates the resource's handler permissions list based on the lifecycle operation
used and any permissions listed in the {@code aws.iam#requiredActions} trait.

@see <a href="https://docs.aws.amazon.com/cloudformation-cli/latest/userguide/resource-type-schema.html#schema-properties-handlers">handlers Docs</a>
smithy-aws-cloudformation/src/main/java/software/amazon/smithy/aws/cloudformation/schema/fromsmithy/mappers/HandlerPermissionMapper.java