aws-lambda: Invalid principal type for Lambda permission statement: CompositePrincipal.

[AlJohri]

Describe the bug

I am getting an error when trying to use a CompositePrincipal to grantInvoke permissions on a lambda.

Expected Behavior

I expect it to work and allow all of the account principals to invoke the lambda.

Current Behavior

Currently it errors out and says it is unsupported with the following error:

Error: Invalid principal type for Lambda permission statement: CompositePrincipal. Supported: AccountPrincipal, ArnPrincipal, ServicePrincipal, OrganizationPrincipal

Reproduction Steps

This code results in the error:

const accounts = new iam.CompositePrincipal(
  new iam.AccountPrincipal('1234'),
  new iam.AccountPrincipal('5678'),
);
myLambda.grantInvoke(accounts);

Possible Solution

No response

Additional Information/Context

Possibly related:

• Invalid principal type for Lambda permission statement: ArnPrincipal. Supported: AccountPrincipal, ServicePrincipal #3264
• fix(lambda): allow ArnPrincipal for lambda grantInvoke #3501

CDK CLI Version

2.95.0 (build cfa7e88)

Framework Version

No response

Node.js Version

v18.17.1

OS

macOS Sonoma

Language

TypeScript

Language Version

TypeScript 5.2

Other information

No response

[msambol]

@peterwoodworth I'll take this.

[msambol]

@AlJohri This currently isn't supported but you can do this:

    const account1 = new iam.AccountPrincipal('111111111111')
    const account2 = new iam.AccountPrincipal('222222222222')
    myLambda.grantInvoke(account1);
    myLambda.grantInvoke(account2);

@peterwoodworth Is this functionality we want to add?

[peterwoodworth]

I don't see why not @msambol, feel free to take

[msambol]

@peterwoodworth I don't think it makes sense to change grantInvoke to accommodate this. I could add a new method if we want to support it, maybe grantInvokeCompositePrincipal (basically a wrapper around grantInvoke). Thoughts?

[vinayak-kukreja]

Hey @msambol, could you tell me why did you not go for accommodating this in grantInvoke function? :)

[msambol]

@vinayak-kukreja I think it would require updating the function declaration? At the very least the return type. So I thought best to create a new method. I'm open to suggestions though if you think we can do it better.

[vinayak-kukreja]

Hey @msambol , I agree, thank you for the clarification.

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.