feat(lambda): warn if you use function.grantInvoke while also using currentVersion

packages/@aws-cdk/aws-lambda/lib/function-base.ts

@@ -1,7 +1,7 @@
 import * as cloudwatch from '@aws-cdk/aws-cloudwatch';
 import * as ec2 from '@aws-cdk/aws-ec2';
 import * as iam from '@aws-cdk/aws-iam';
-import { ArnFormat, ConstructNode, IResource, Resource, Token } from '@aws-cdk/core';
+import { Annotations, ArnFormat, ConstructNode, IResource, Resource, Token } from '@aws-cdk/core';
 import { AliasOptions } from './alias';
 import { Architecture } from './architecture';
 import { EventInvokeConfig, EventInvokeConfigOptions } from './event-invoke-config';
@@ -12,6 +12,10 @@ import { CfnPermission } from './lambda.generated';
 import { Permission } from './permission';
 import { addAlias, flatMap } from './util';
 
+// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
+// eslint-disable-next-line no-duplicate-imports, import/order
+import { Construct } from '@aws-cdk/core';
+
 export interface IFunction extends IResource, ec2.IConnectable, iam.IGrantable {
 
   /**
@@ -267,6 +271,22 @@ export abstract class FunctionBase extends Resource implements IFunction, ec2.IC
    */
   protected _invocationGrants: Record<string, iam.Grant> = {};
 
+  /**
+   * Adds a warning to function permissions that include `lambda:InvokeFunction`.
+   * This should apply only to permissions on Lambda functions, not versions or aliases.
+   * This function is overridden as a noOp for QualifiedFunctionBase.
+   */
+  public addWarningOnInvokeFunctionPermissions(scope: Construct, action: string) {
+    const affectedPermissions = ['lambda:InvokeFunction', 'lambda:*', 'lambda:Invoke*'];
+    if (affectedPermissions.includes(action)) {
+      Annotations.of(scope).addWarning([
+        "AWS Lambda has changed their authorization strategy, which may cause client invocations using the 'Qualifier' parameter of the lambda function to fail with Access Denied errors.",
+        "If you are using a lambda Version or Alias, make sure to call 'grantInvoke' or 'addPermission' on the Version or Alias, not the underlying Function",
+        'See: https://github.com/aws/aws-cdk/issues/19273',
+      ].join('\n'));
+    }
+  }
+
   /**
    * Adds a permission to the Lambda resource policy.
    * @param id The id for the permission construct
@@ -283,6 +303,8 @@ export abstract class FunctionBase extends Resource implements IFunction, ec2.IC
     const action = permission.action ?? 'lambda:InvokeFunction';
     const scope = permission.scope ?? this;
 
+    this.addWarningOnInvokeFunctionPermissions(scope, action);
+
     new CfnPermission(scope, id, {
       action,
       principal,
@@ -537,6 +559,11 @@ export abstract class QualifiedFunctionBase extends FunctionBase {
       ...options,
     });
   }
+
+  public addWarningOnInvokeFunctionPermissions(_scope: Construct, _action: string): void {
+    // noOp
+    return;
+  }
 }
 
 /**

packages/@aws-cdk/aws-lambda/test/function.test.ts

@@ -1,5 +1,5 @@
 import * as path from 'path';
-import { Match, Template } from '@aws-cdk/assertions';
+import { Annotations, Match, Template } from '@aws-cdk/assertions';
 import { ProfilingGroup } from '@aws-cdk/aws-codeguruprofiler';
 import * as ec2 from '@aws-cdk/aws-ec2';
 import * as efs from '@aws-cdk/aws-efs';
@@ -435,6 +435,103 @@ describe('function', () => {
       // THEN
       Template.fromStack(stack).resourceCountIs('AWS::Lambda::Permission', 0);
     });
+
+    describe('annotations on different IFunctions', () => {
+      let stack: cdk.Stack;
+      let fn: lambda.Function;
+      let warningMessage: string;
+      beforeEach(() => {
+        warningMessage = 'AWS Lambda has changed their authorization strategy';
+        stack = new cdk.Stack();
+        fn = new lambda.Function(stack, 'MyLambda', {
+          code: lambda.Code.fromAsset(path.join(__dirname, 'my-lambda-handler')),
+          handler: 'index.handler',
+          runtime: lambda.Runtime.PYTHON_3_6,
+        });
+      });
+
+      test('function', () => {
+        // WHEN
+        fn.addPermission('MyPermission', {
+          principal: new iam.ServicePrincipal('lambda.amazonaws.com'),
+        });
+
+        // THEN
+        Annotations.fromStack(stack).hasWarning('/Default/MyLambda', Match.stringLikeRegexp(warningMessage));
+      });
+
+      test('version', () => {
+        // GIVEN
+        const version = new lambda.Version(stack, 'MyVersion', {
+          lambda: fn,
+        });
+
+        // WHEN
+        version.addPermission('MyPermission', {
+          principal: new iam.ServicePrincipal('lambda.amazonaws.com'),
+        });
+
+        // THEN
+        Annotations.fromStack(stack).hasNoWarning('/Default/MyVersion', Match.stringLikeRegexp(warningMessage));
+      });
+
+      test('latest version', () => {
+        // WHEN
+        fn.latestVersion.addPermission('MyPermission', {
+          principal: new iam.ServicePrincipal('lambda.amazonaws.com'),
+        });
+
+        // THEN
+        // cannot add permissions on latest version, so no warning necessary
+        Annotations.fromStack(stack).hasNoWarning('/Default/MyLambda/$LATEST', Match.stringLikeRegexp(warningMessage));
+      });
+
+      test('alias', () => {
+        // GIVEN
+        const version = new lambda.Version(stack, 'MyVersion', {
+          lambda: fn,
+        });
+        const alias = new lambda.Alias(stack, 'MyAlias', {
+          aliasName: 'alias',
+          version,
+        });
+
+        // WHEN
+        alias.addPermission('MyPermission', {
+          principal: new iam.ServicePrincipal('lambda.amazonaws.com'),
+        });
+
+        // THEN
+        Annotations.fromStack(stack).hasNoWarning('/Default/MyAlias', Match.stringLikeRegexp(warningMessage));
+      });
+
+      test('alias on latest version', () => {
+        // GIVEN
+        const alias = new lambda.Alias(stack, 'MyAlias', {
+          aliasName: 'alias',
+          version: fn.latestVersion,
+        });
+
+        // WHEN
+        alias.addPermission('MyPermission', {
+          principal: new iam.ServicePrincipal('lambda.amazonaws.com'),
+        });
+
+        // THEN
+        Annotations.fromStack(stack).hasNoWarning('/Default/MyAlias', Match.stringLikeRegexp(warningMessage));
+      });
+
+      test('function without lambda:InvokeFunction', () => {
+        // WHEN
+        fn.addPermission('MyPermission', {
+          action: 'lambda.GetFunction',
+          principal: new iam.ServicePrincipal('lambda.amazonaws.com'),
+        });
+
+        // THEN
+        Annotations.fromStack(stack).hasNoWarning('/Default/MyLambda', Match.stringLikeRegexp(warningMessage));
+      });
+    });
   });
 
   test('Lambda code can be read from a local directory via an asset', () => {