fix(lambda): failed to add permission to an imported lambda from another account

packages/@aws-cdk/aws-lambda/lib/function-base.ts

@@ -149,6 +149,17 @@ export interface FunctionAttributes {
    * to this Lambda.
    */
   readonly securityGroup?: ec2.ISecurityGroup;
+
+  /**
+   * Setting this property informs the CDK that permissions can be added to this function.
+   * When not configured, the CDK attempts to auto-determine this. If determined as false, adding permission
+   * to this function will fail.
+   *
+   * Set this to property *ONLY IF* the imported function is in the same account as the stack
+   * it's imported in.
+   * @default - true, if the Stack is configured with an `env` and the account is the same as this function. false, otherwise.
+   */
+  readonly allowPermissions?: boolean;
 }
 
 export abstract class FunctionBase extends Resource implements IFunction {
@@ -301,7 +312,8 @@ export abstract class FunctionBase extends Resource implements IFunction {
 
             const permissionNode = this._functionNode().tryFindChild(identifier);
             if (!permissionNode) {
-              throw new Error('Cannot modify permission to lambda function. Function is either imported or $LATEST version.');
+              throw new Error('Cannot modify permission to lambda function. Function is either imported or $LATEST version. '
+                + 'If the function is imported from the same account use `fromFunctionAttributes()` API with the `allowPermissions` flag.');
             }
             return { statementAdded: true, policyDependable: permissionNode };
           },
@@ -367,7 +379,7 @@ export abstract class FunctionBase extends Resource implements IFunction {
    */
   protected _isStackAccount(): boolean {
     if (Token.isUnresolved(this.stack.account) || Token.isUnresolved(this.functionArn)) {
-      return true;
+      return false;
     }
     return this.stack.parseArn(this.functionArn).account === this.stack.account;
   }

packages/@aws-cdk/aws-lambda/lib/function.ts

@@ -383,7 +383,7 @@ export class Function extends FunctionBase {
       public readonly role = role;
       public readonly permissionsNode = this.node;
 
-      protected readonly canCreatePermissions = this._isStackAccount();
+      protected readonly canCreatePermissions = attrs.allowPermissions ?? this._isStackAccount();
 
       constructor(s: Construct, i: string) {
         super(s, i);

packages/@aws-cdk/aws-lambda/test/function.test.ts

@@ -269,6 +269,24 @@ describe('function', () => {
         principal: new iam.ServicePrincipal('cloudformation.amazonaws.com'),
       });
 
+      // THEN
+      expect(stack).not.toHaveResource('AWS::Lambda::Permission');
+    });
+
+    test('imported Function w/ unresolved account & allowPermissions set', () => {
+      // GIVEN
+      const app = new cdk.App();
+      const stack = new cdk.Stack(app, 'Imports');
+
+      // WHEN
+      const iFunc = lambda.Function.fromFunctionAttributes(stack, 'iFunc', {
+        functionArn: 'arn:aws:lambda:us-east-1:123456789012:function:BaseFunction',
+        allowPermissions: true,
+      });
+      iFunc.addPermission('iFunc', {
+        principal: new iam.ServicePrincipal('cloudformation.amazonaws.com'),
+      });
+
       // THEN
       expect(stack).toHaveResource('AWS::Lambda::Permission');
     });
@@ -953,10 +971,22 @@ describe('function', () => {
     });
 
     test('on an imported function (unresolved account)', () => {
-      // GIVEN
       const stack = new cdk.Stack();
       const fn = lambda.Function.fromFunctionArn(stack, 'Function', 'arn:aws:lambda:us-east-1:123456789012:function:MyFn');
 
+      expect(
+        () => fn.grantInvoke(new iam.ServicePrincipal('elasticloadbalancing.amazonaws.com')),
+      ).toThrow(/Cannot modify permission to lambda function/);
+    });
+
+    test('on an imported function (unresolved account & w/ allowPermissions)', () => {
+      // GIVEN
+      const stack = new cdk.Stack();
+      const fn = lambda.Function.fromFunctionAttributes(stack, 'Function', {
+        functionArn: 'arn:aws:lambda:us-east-1:123456789012:function:MyFn',
+        allowPermissions: true,
+      });
+
       // WHEN
       fn.grantInvoke(new iam.ServicePrincipal('elasticloadbalancing.amazonaws.com'));