(aws-lambda): grant invoke twice with different principals #15710
Description
I grant invoke for my lambda to 2 different principles and only one resource policy created.
Reproduction Steps
lambda.grantInvoke(new ServicePrincipal('s3.amazonaws.com').withConditions({
ArnLike: {
'aws:SourceArn': aBucket.bucketArn,
},
StringEquals: {
'aws:SourceAccount': this.node.tryGetContext('account'),
},
}))
lambda.grantInvoke(new ServicePrincipal('s3.amazonaws.com').withConditions({
ArnLike: {
'aws:SourceArn': bBucket.bucketArn,
},
StringEquals: {
'aws:SourceAccount': this.node.tryGetContext('account'),
},
}))
Expect 2 different resource policies created
What actually happened?
Deployment went ok, only first policy created
Statement ID: LambdaInvokeServicePrincipals3amazonawscomF32-78TTVCKWLPHK
Principal: s3.amazonaws.com
Effect: Allow
Action: lambda:InvokeFunction
Conditions: {
"StringEquals": {
"AWS:SourceAccount": "111122223333"
},
"ArnLike": {
"AWS:SourceArn": "arn:aws:s3:::a-bucket"
}
}
Environment
- **CDK CLI Version : 1.115.0
- **Node.js Version: v14.17.3
- **OS: Windows
- **Language (Version): TypeScript
This is 🐛 Bug Report