(lambda): fromFunctionArn no longer working

[alamathe1]

What is the problem?

We are facing an error with CDK version 1.143.0 with the following usage:

const isCompleteHandler = Function.fromFunctionArn(
      this,
      'IsCompleteHandler',
      options.isCompleteHandlerArn,
    );
    const onEventHandler = Function.fromFunctionArn(
      this,
      'OnEventHandler',
      options.onEventHandlerArn,
    );

The above code fails when sameEnviroment flag is not explicitly set to true. Workaround used today:

const isCompleteHandler = Function.fromFunctionAttributes(this, 'IsCompleteHandler', { functionArn: options.isCompleteHandlerArn, sameEnvironment: true });

const onEventHandler = Function.fromFunctionAttributes(this, 'OnEventHandler', { functionArn: options.onEventHandlerArn, sameEnvironment: true});

NOTE: The issue is not seen on previously used CDK version 1.111.0.

Reproduction Steps

This is used by an internal amazon package. Following is an error snippet with the CDK package is complied:

What did you expect to happen?

Expected the CDK package to compile successfully without any errors.

What actually happened?

Build failed with the error:

/Volumes/workplace/Pipe/src/IvyEdgeReleaseCDK/node_modules/monocdk/lib/aws-lambda/lib/function-base.js:145
                            throw new Error('Cannot modify permission to lambda function. Function is either imported or $LATEST version. '
                            ^

Error: Cannot modify permission to lambda function. Function is either imported or $LATEST version. If the function is imported from the same account use `fromFunctionAttributes()` API with the `sameEnvironment` flag.
    at Object.addToResourcePolicy (/Volumes/workplace/Pipe/src/IvyEdgeReleaseCDK/node_modules/monocdk/lib/aws-lambda/lib/function-base.js:145:35)
    at Function.addToPrincipalOrResource (/Volumes/workplace/Pipe/src/IvyEdgeReleaseCDK/node_modules/monocdk/lib/aws-iam/lib/grant.js:72:49)
    at Import.grantInvoke (/Volumes/workplace/Pipe/src/IvyEdgeReleaseCDK/node_modules/monocdk/lib/aws-lambda/lib/function-base.js:130:31)
    at Provider.createFunction (/Volumes/workplace/Pipe/src/IvyEdgeReleaseCDK/node_modules/monocdk/lib/custom-resources/lib/provider-framework/provider.js:87:29)
    at new Provider (/Volumes/workplace/Pipe/src/IvyEdgeReleaseCDK/node_modules/monocdk/lib/custom-resources/lib/provider-framework/provider.js:41:38)
    at GetParametersStack.createResource (/Volumes/workplace/Pipe/src/IvyEdgeReleaseCDK/node_modules/@amzn/ringleader-constructs/dist/stacks/GetParameters.js:30:26)
    at new GetParametersStack (/Volumes/workplace/Pipe/src/IvyEdgeReleaseCDK/node_modules/@amzn/ringleader-constructs/dist/stacks/GetParameters.js:25:20)
    at Object.generateReleaseStacks [as default] (/Volumes/workplace/Pipe/src/IvyEdgeReleaseCDK/dist/lib/generateReleaseStacks.js:35:28)
    at stackGeneratorWithTests (/Volumes/workplace/Pipe/src/IvyEdgeReleaseCDK/dist/lib/createInfrastructure.js:19:211)
    at addEnvStackToDeploymentGroupStage (/Volumes/workplace/Pipe/src/IvyEdgeReleaseCDK/node_modules/@amzn/herbie-console-common-cdk/dist/createPipeline/createDeploymentGroup.js:18:41)
Subprocess exited with error 1
    Error: Failed to run cdk synth:
    null
                                                            
                        BUILD FAILED                        
                                                            
                                                                         
  *** command 'cdk-build' with arguments '' exited with return code '1'  
                                                                         
3c22fb02d71a:IvyEdgeReleaseCDK lamathe$

CDK CLI Version

1.143.0

Framework Version

No response

Node.js Version

12.22.9

OS

macos

Language

Typescript

Language Version

4.1.3

Other information

No response

[kaizencc]

Related to #18781, please see #18781 (comment) for my take on what is going on.

@alamathe1, a couple of questions:

• the above code doesn't fail as is right? It should fail when you try to do something with the lambda functions.
• do the functions come from the same region/account or different region/account (environment)

[alamathe1]

@kaizen3031593

• The code fails when we try to do something with the lambda functions.
• The functions are from different accounts.

[kaizencc]

Cool! Going to close this as a duplicate of #18781, since it is the same use case. There's some good information on what's happening in that thread.

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.