# Permission

Represents a permission statement that can be added to a Lambda function's resource policy via the `addPermission()` method.

- Source: [`aws-lambda/lib/permission.ts`](https://github.com/aws/aws-cdk/blob/v2.274.0/packages/aws-cdk-lib/aws-lambda/lib/permission.ts#L9)
- Type last changed: v2.220.0 · 14 Oct 2025

## Example

```ts
// Grant permissions to a service
declare const fn: lambda.Function;
const principal = new iam.ServicePrincipal('my-service');

fn.grantInvoke(principal);

// Equivalent to:
fn.addPermission('my-service Invocation', {
  principal: principal,
});
```

## Properties

- `action`: string = 'lambda:InvokeFunction' — The Lambda actions that you want to allow in this statement.

  For example,
  you can specify lambda:CreateFunction to specify a certain action, or use
  a wildcard (``lambda:*``) to grant permission to all Lambda actions. For a
  list of actions, see Actions and Condition Context Keys for AWS Lambda in
  the IAM User Guide.

- `eventSourceToken`: string — A unique token that must be supplied by the principal invoking the function.

  **Default:** The caller would not need to present a token.

- `functionUrlAuthType`: [FunctionUrlAuthType](/cdk/api/v2/docs/aws-cdk-lib.aws_lambda.FunctionUrlAuthType.html) — The authType for the function URL that you are granting permissions for.

  **Default:** No functionUrlAuthType

- `invokedViaFunctionUrl`: boolean = false — The condition key for limiting the scope of lambda:InvokeFunction action to Function URL only.

  When set to true, it restricts the principal in this policy to perform invokes for the resource only via Function URLs.

- `organizationId`: string — The organization you want to grant permissions to.

  **Default:** No organizationId

  Use this ONLY if you
  need to grant permissions to a subset of the organization. If you want to
  grant permissions to the entire organization, sending the organization principal
  through the `principal` property will suffice.

  You can use this property to ensure that all source principals are owned by
  a specific organization.

- `principal`: [IPrincipal](/cdk/api/v2/docs/aws-cdk-lib.aws_iam.IPrincipal.html) (required) — The entity for which you are granting permission to invoke the Lambda function.

  This entity can be any of the following:

  - a valid AWS service principal, such as `s3.amazonaws.com` or `sns.amazonaws.com`
  - an AWS account ID for cross-account permissions. For example, you might want
    to allow a custom application in another AWS account to push events to
    Lambda by invoking your function.
  - an AWS organization principal to grant permissions to an entire organization.

  The principal can be an AccountPrincipal, an ArnPrincipal, a ServicePrincipal,
  or an OrganizationPrincipal.

- `scope`: [Construct](/cdk/api/v2/docs/constructs.Construct.html) — The scope to which the permission constructs be attached.

  **Default:** The instance of lambda.IFunction

  The default is
  the Lambda function construct itself, but this would need to be different
  in cases such as cross-stack references where the Permissions would need
  to sit closer to the consumer of this permission (i.e., the caller).

- `sourceAccount`: string — The AWS account ID (without hyphens) of the source owner.

  For example, if
  you specify an S3 bucket in the SourceArn property, this value is the
  bucket owner's account ID. You can use this property to ensure that all
  source principals are owned by a specific account.

- `sourceArn`: string — The ARN of a resource that is invoking your function.

  When granting
  Amazon Simple Storage Service (Amazon S3) permission to invoke your
  function, specify this property with the bucket ARN as its value. This
  ensures that events generated only from the specified bucket, not just
  any bucket from any AWS account that creates a mapping to your function,
  can invoke the function.