Lambda: Principal conditions don't get translated to AWS::Lambda::Permissions fields

Trying to great a ServicePrincipal for use in a Function.grantInvoke call.

Want to add conditions so that it is scoped to a particular bucket ala e.g. here https://docs.aws.amazon.com/lambda/latest/dg/access-control-resource-based.html

I’ve tried varaitions in conditions for the keys like arnLike awsSourceArn

tried using this as reference

https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN

How is this supposed to work? No examples in docs or elsewhere on interwebs

Reproduction Steps

        const spOptions = {
            conditions:{
                'arn:like':{
                    "aws:SourceArn" : bucketName
                }
            }
        }
        const sp = new ServicePrincipal('s3.amazonaws.com', spOptions)
        console.log('Service Principal', sp.policyFragment)
        this.launcherFunction.grantInvoke(sp)

doing this i see my conditions in the policyFragment output but doesn’t generate any conditions in the resulting cloudformation

{
      "Type": "AWS::Lambda::Permission",
      "Properties": {
        "Action": "lambda:InvokeFunction",
        "FunctionName": {
          "Fn::GetAtt": [
            "xxxLauncher5BB90C90",
            "Arn"
          ]
        },
        "Principal": "s3.amazonaws.com"
      },
      "Metadata": {
       ...
      }
    }

Error Log

Environment

• **CLI Version : aws-cli/2.0.9
• Framework Version: 1.40.0
• **OS 😗*ubuntu 16.04
• Language : typescript

Other

---

This is 🐛 Bug Report

[david-wang-1]

Any updates on prioritization for this fix? The workaround from @rix0rrr does not appear to work.

[ScDavid]

I experienced the same problem. Additionally using PrincipalWithConditions seems no to be supported as principal in Lambda permission: Invalid principal type for Lambda permission statement: PrincipalWithConditions. Supported: AccountPrincipal, ArnPrincipal, ServicePrincipal