Add Resource-based policy to allow Pinpoint invoke lambda function

[biller-aivy]

Amplify CLI Version

10.5.2

Question

Hey Guys,

I try to connect a Pinpoint Journey with my Lambda function to invoke lambda based on a analytics event.

So this is working when I use the Console to add a Resource-based policy:

{
      "Sid": "custom-test",
      "Effect": "Allow",
      "Principal": {
        "Service": "pinpoint.amazonaws.com"
      },
      "Action": "lambda:InvokeFunction",
      "Resource": "arn:aws:lambda:eu-central-1:XXX:function:pinpointEventsHandler-develop",
      "Condition": {
        "ArnLike": {
          "AWS:SourceArn": "arn:aws:mobiletargeting:eu-central-1:XXX:apps/*"
        }
      }
    }

I can't find this part in the template at the console from cloudformation.

With the Amplify CLI I can add this how?

With the custom policy flow it is not working:

{
    "Action": ["lambda:InvokeFunction"],
    "Resource": ["arn:aws:mobiletargeting:eu-central-1:XXX:apps/*"]
  }

Any Idea?

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-permission.html

[biller-aivy]

Solution:

"PermissionForPinpointToInvokeLambda": {
      "Type": "AWS::Lambda::Permission",
      "Properties": {
        "FunctionName": {
          "Ref": "LambdaFunction"
        },
        "Action": "lambda:InvokeFunction",
        "Principal": "pinpoint.amazonaws.com",
        "SourceArn": {
          "Fn::Sub": "arn:aws:mobiletargeting:${AWS::Region}:${AWS::AccountId}:apps/*"
        }
      }
    }

Maybe we can add instead of just custom-policies.json the custom-permissions too for other users?

[ykethan]

Hey @biller-aivy, 👋 thank you for reaching out. Support for Lambda resource policies is currently being tracked on #9093.
If you could add a 👍 on the issue, this would help us prioritize the feature request.

[josefaidt]

Closing in favor of tracking #9093

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.