aws-lambda: addPermission doesn't allow overriding auto-generated statement ID

[garysassano]

Description

When using addPermission method on a Lambda function, CDK generates a resource-based policy statement with an auto-generated statement ID that begins with the construct path. There is currently no way to override this behavior and specify a custom statement ID that will be used in the actual AWS resource.

Current Behavior

When calling addPermission with a statement ID like:

myFunction.addPermission("AllowCWL", {
  principal: new ServicePrincipal("logs.amazonaws.com"),
  action: "lambda:InvokeFunction",
  sourceArn: `arn:aws:logs:${this.region}:${this.account}:log-group:*`,
  sourceAccount: this.account,
});

The statement ID in the actual Lambda resource-based policy becomes something like:
<stack-name>-<function-name><policy-logic-id><random-id>

As seen in the AWS Console:

Expected Behavior

The addPermission method should have an optional property to specify the exact statement ID to use in the deployed resource-based policy. For example:

myFunction.addPermission("AllowCWL", {
  principal: new ServicePrincipal("logs.amazonaws.com"),
  action: "lambda:InvokeFunction",
  sourceArn: `arn:aws:logs:${this.region}:${this.account}:log-group:*`,
  sourceAccount: this.account,
  statementId: "AllowCWL" // <-- Proposed property to override the auto-generated ID
});

Additional Information

The AWS Lambda API itself allows specifying the statement ID directly when adding permissions. This feature request is to expose this capability through the CDK API.

AWS Lambda API vs. CDK Implementation

Lambda API Behavior

• The native AddPermission API requires a user-specified StatementId parameter
• This ID must be unique within the function's policy
• Manual AWS CLI command example:

  aws lambda add-permission \
    --function-name my-function \
    --action lambda:InvokeFunction \
    --statement-id AllowCWL \
    --principal logs.amazonaws.com \
    --source-arn arn:aws:logs:us-west-2:123456789012:log-group:* \
    --source-account 123456789012

CDK Current Implementation

• CDK auto-generates statement IDs using construct paths and logical IDs
• Generated IDs follow pattern: <stack-name>-<function-name><policy-logic-id><random-id>
• No exposed statementId property in Permission interface:

  // Current CDK interface (simplified)
  interface Permission {
    principal: IPrincipal;
    action?: string;
    sourceArn?: string;
    // Missing statementId property
  }
  
  // Proposed solution would require
  interface Permission {
    // ...existing properties
    statementId?: string; // New optional property
  }

Current Workaround (Complex and Fragile)

// Using escape hatch to modify generated policy
const cfnFunc = myFunction.node.defaultChild as lambda.CfnFunction;
cfnFunc.addOverride('Properties.Policy.Statement.0.Sid', 'CustomID');

CDK CLI Version

2.190.0

Framework Version

No response

Node.js Version

22.14.0

OS

Ubuntu 24.04

Language

TypeScript

Language Version

No response

Other information

No response

[ykethan]

Hey @garysassano , Thanks for reporting this issue. The requested change would require modifications to two key files:

In packages/aws-cdk-lib/aws-lambda/lib/permission.ts, we'd need to add the statementId property to the Permission interface:

export interface Permission {
  /**
   * The statement ID to use for this permission statement. If not provided,
   * CDK will auto-generate an ID using the construct path.
   * 
   * @default - Auto-generated using construct path and a random suffix
   */
  readonly statementId?: string;

  // ... existing properties ...
}

In packages/aws-cdk-lib/aws-lambda/lib/function-base.ts, we'd need to modify the addPermission implementation to use the provided statementId when creating the CfnPermission:

public addPermission(id: string, permission: Permission) {
  // ... existing checks ...

  new CfnPermission(scope, id, {
    action,
    principal,
    functionName: this.functionArn,
    sid: permission.statementId ?? id,  // Use provided statementId or fallback to id
    eventSourceToken: permission.eventSourceToken,
    sourceAccount: permission.sourceAccount ?? sourceAccount,
    sourceArn: permission.sourceArn ?? sourceArn,
    principalOrgId: permission.organizationId ?? principalOrgID,
    functionUrlAuthType: permission.functionUrlAuthType,
  });
}

This would allow users to control the statement ID while maintaining backward compatibility with the current auto-generation behavior.

I am making this a p2 feature request and any PR would be appreciated!

[ykethan]

@garysassano on diving further into this, noticed the statement-id is currently not provided on AWS::Lambda::Permission CloudFormation resource.
But is currently supported on AWS CLI and AWS SDK.
https://docs.aws.amazon.com/cli/latest/reference/lambda/add-permission.html
https://docs.aws.amazon.com/lambda/latest/api/API_AddPermission.html

I would suggest opening a issue on cloudformation-coverage-roadmap repository to track this implementation.

Internal ticket for tracking: V1751760064

[github-actions]

This issue has not received a response in a while. If you want to keep this issue open, please leave a comment below and auto-close will be canceled.

[garysassano]

keep