[sns] Lambda function in different region subscription error

I had this working before in previous CDK version. However, not working in recent CDK version. I have a lambda function in ap-southeast-2 region, I am trying to add that lambda function in the sns topic subscriber in us-east-1 region. From the AWS console, I can find the function arn and make it as sns subscriber, however not from cdk.

Reproduction Steps

Lambda function imported

const snsSubscriberLambda = lambda.Function.fromFunctionArn( this, “snsSubsciberLambda”, “arn:aws:lambda:ap-southeast-2:XXXXXXX:function:XXXX” ); // add snsSubsciberLambda as topic subscriber topic.addSubscription( new subscription.LambdaSubscription(snsSubscriberLambda) );

This will result in error like the following: Functions from ‘ap-southeast-2’ are not reachable in this region (‘us-east-1’) (Service: AWSLambda; Status Code: 404; Error Code: ResourceNotFoundException; Request ID: XXXXXXX; Proxy: null)

What did you expect to happen?

There should be no error creating a subscription for lambda function in other region.

What actually happened?

Permission error occurred.

snsSubsciberLambda/AllowInvoke:XXXXXXX

Environment

• CLI Version :1.68.0
• Framework Version:
• Node.js Version:v12.14.1
• OS :Windows
• Language (Version):TypeScript (4.0.3)

Other

---

This is 🐛 Bug Report

[alexb-uk]

I’m running 1.70.0 and am also seeing this error when trying to subscribe a London region Lambda function to an SNS Topic in Ireland.

If anyone knows of a workaround that would be really helpful? Thanks

[davidnewhall]

Use fromFunctionAttributes instead of fromFunctionArn and set sameEnvironment to false. This will prevent CDK/CFN from trying to add invoke permissions to a lambda in another region (that it cannot reach).