Advanced AI Prompt for CI/CD Deployment Role with iam:PassRole Restrictions

Act as a DevSecOps IAM Specialist. Construct a secure IAM policy for an automated CI/CD deployment machine user [DEPLOYMENT_ROLE_ARN]. The policy must authorize the user to perform `lambda:CreateFunction` and `lambda:UpdateFunctionCode` operations strictly within [TARGET_REGION]. Critically, to prevent severe privilege escalation, restrict the `iam:PassRole` action so the CI/CD pipeline can *only* pass the explicitly defined role [LAMBDA_ROLE_ARN] to the Lambda service. Utilize a `StringEquals` condition verifying that the `iam:PassedToService` key is exactly `lambda.amazonaws.com`.