(@aws-cdk/aws-iot): New Rule does not call Action

When I add a new IoT Rule+Action through CDK, the Action is not used until I make changes through the Console.

Reproduction Steps

1. Make a Lambda, for example:

exports.handler = async (event) => {  console.log("testlambda", event); };

1. Create an IoT rule + Action (Important: Create a new rule with a new name):

new CfnTopicRule(stack, "testAJKL1243242Topic",
    new CfnTopicRuleProps
    {
        RuleName = "testAJKL1243242Topic",
        TopicRulePayload = new CfnTopicRule.TopicRulePayloadProperty
        {
            Actions = new object[]
            {
                new CfnTopicRule.ActionProperty
                {
                    Lambda = new CfnTopicRule.LambdaActionProperty { FunctionArn = "arn:aws:lambda:eu-west-1:accountid:function:testlambda" }
                }
            },
            Sql = "SELECT * FROM \"test\"",
            RuleDisabled = false,
            AwsIotSqlVersion = "2016-03-23",
        }
    });

1. Open the Console and publish a message to the “test” topic
2. Check the CloudWatch output of the Lambda --> Lambda is not called

As a workaround you can make it work by adding a “Error action” through Console and remove it again. 5. Go to the Console, and add a CloudWatch log action to the “Error action” 6. Remove the CloudWatch log action 7. Repeat step 3 and 4, now you will see output in step 4.

What did you expect to happen?

I expect the Lambda to be called.

What actually happened?

Nothing?

Environment

• CDK CLI Version : 1.86.0 (build a10cfcf)
• Framework Version: (which framework?)
• Node.js Version: v14.15.3
• OS : Windows 10
• Language (Version): C# .NET 3.1, referenced CDK 1.86.0 Nuget packages

Other

Region: eu-west-1. Using the CDK since version 1.73.0, and I think it was already an issue in that version, at least it is not new in 1.86.0.

---

This is 🐛 Bug Report

[olivierpichon]

Found the reason for this issue, you need to setup a CfnPermission for the lambda function to be invoked. It can be defined this way:

    new CfnPermission(this, "InvokeLambdaToTimeScalePermission", {
      action: "lambda:InvokeFunction",
      functionName: fn.functionArn,
      principal: "iot.amazonaws.com",
      sourceArn: rule.attrArn
    })

Because it fails silently without this permission, and it is quite impossible for someone to tell what’s missing, I would suggest that CDK automatically creates this resource (as its main goal and philosophy is to come with sensible default)

[olivierpichon]

Can confirm it is a Cloudformation bug