Permission resource is not created for imported lambda function

Resource Policy is not being created for Lambda when using Lambda version but is being created when using new Lambda.

Reproduction Steps:

• Create a new lambda function and publish a new version for it.

• Create a new resource policy for the created lambda version.

Example shows creating new resource policy for api gateway to invoke weatherFunction lambda version 13

_lambda.Version.from_version_attributes(self, id='stageVersion',lambda_=weatherFunction,version='13').add_permission(id='invokeweatherfnversion13',principal=iam.ServicePrincipal(service='apigateway.amazonaws.com'),
        action='lambda:InvokeFunction',source_arn=api.arn_for_execute_api(stage='dev', method='GET',path='/')
        )

Error Log

No error message

Environment

• **CLI Version : 1.34.1
• **Framework Version: 1.34.1
• **OS : Mac Mojave 10.14.6
• **Language :Python

Other

---

This is 🐛 Bug Report

[A-Hilaly]

@SKIIDK - canCreatePermissions is a protected member of the class. You cannot control it from outside the class.

Work around is to create a CfnPermission class like so -

https://github.com/aws/aws-cdk/blob/6407535863c06d6d3ccfc2c3f2b59470d2d88993/packages/%40aws-cdk/aws-lambda/lib/function-base.ts#L212-L219

With @Hugodby we found a detailed work around using this template, with apigateway and lambda authorizers

        // parameters
        const authorizerFunctionArn = new cdk.CfnParameter(this, "authorizerFunctionArn", {
          type: "String",
          default: "arn:aws:lambda:eu-west-1:XXXXXXXXX:XXXXXXXXX",
          description: "ARN of the LambdaAuthorizer"},
        );

       // authorizer lambda
        const authFunction = lambda.Function.fromFunctionArn(this,
          "lambda-authorizer",
          authorizerFunctionArn.valueAsString,
        )
        
        // api gateway
        const TestApi = new apigateway.RestApi(this, 'TestApi', {
            restApiName: 'TestService'
        });

        new lambda.CfnPermission(this, id+"test01", {
          action: "lambda:InvokeFunction",
          principal: 'apigateway.amazonaws.com',
          functionName: authorizerFunctionArn.valueAsString,
          sourceArn: cdk.Arn.format(
            {
              service: "execute-api", 
              resource: TestApi.restApiId,
              resourceName: "authorizers/*",
            },
            this,
          ),
        });

[nija-at]

@SKIIDK - canCreatePermissions is a protected member of the class. You cannot control it from outside the class.

Work around is to create a CfnPermission class like so - https://github.com/aws/aws-cdk/blob/6407535863c06d6d3ccfc2c3f2b59470d2d88993/packages/%40aws-cdk/aws-lambda/lib/function-base.ts#L212-L219