Permission Struct
Represents a permission statement that can be added to a Lambda function's resource policy via the addPermission() method.
Example
// Grant permissions to a service
declare const fn: lambda.Function;
const principal = new iam.ServicePrincipal('my-service');
fn.grantInvoke(principal);
// Equivalent to:
fn.addPermission('my-service Invocation', {
principal: principal,
});
Properties
notes
For example, you can specify lambda:CreateFunction to specify a certain action, or use a wildcard (lambda:*) to grant permission to all Lambda actions. For a list of actions, see Actions and Condition Context Keys for AWS Lambda in the IAM User Guide.
eventSourceTokenstringevent_source_tokenstreventSourceTokenStringEventSourceTokenstringEventSourceToken*string= The caller would not need to pre…#default
Default: The caller would not need to present a token.
functionUrlAuthTypeFunctionUrlAuthTypefunction_url_auth_typeFunctionUrlAuthTypefunctionUrlAuthTypeFunctionUrlAuthTypeFunctionUrlAuthTypeFunctionUrlAuthTypeFunctionUrlAuthTypeFunctionUrlAuthType= No functionUrlAuthType#invokedViaFunctionUrlbooleaninvoked_via_function_urlboolinvokedViaFunctionUrlBooleanInvokedViaFunctionUrlboolInvokedViaFunctionUrl*bool= false#When set to true, it restricts the principal in this policy to perform invokes for the resource only via Function URLs.
organizationIdstringorganization_idstrorganizationIdStringOrganizationIdstringOrganizationId*string= No organizationId#notes
Use this ONLY if you need to grant permissions to a subset of the organization. If you want to grant permissions to the entire organization, sending the organization principal through the principal property will suffice.
You can use this property to ensure that all source principals are owned by a specific organization.
principalIPrincipalprincipalIPrincipalprincipalIPrincipalPrincipalIPrincipalPrincipalIPrincipalrequired#notes
This entity can be any of the following:
- a valid AWS service principal, such as
s3.amazonaws.comorsns.amazonaws.com - an AWS account ID for cross-account permissions. For example, you might want to allow a custom application in another AWS account to push events to Lambda by invoking your function.
- an AWS organization principal to grant permissions to an entire organization.
The principal can be an AccountPrincipal, an ArnPrincipal, a ServicePrincipal, or an OrganizationPrincipal.
scopeConstructscopeConstructscopeConstructScopeConstructScopeConstruct= The instance of lambda.IFunction#The default is the Lambda function construct itself, but this would need to be different in cases such as cross-stack references where the Permissions would need to sit closer to the consumer of this permission (i.e., the caller).
For example, if you specify an S3 bucket in the SourceArn property, this value is the bucket owner's account ID. You can use this property to ensure that all source principals are owned by a specific account.
notes
When granting Amazon Simple Storage Service (Amazon S3) permission to invoke your function, specify this property with the bucket ARN as its value. This ensures that events generated only from the specified bucket, not just any bucket from any AWS account that creates a mapping to your function, can invoke the function.