What is the problem?

The .addPermission() and .grantInvoke() functions do not allow adding an AWS Organizations ID for resource-based policies. This is a feature in the AWS CLI, as seen here in the docs. I get an error when I try to add an organizations ID as a condition.

Reproduction Steps

Let orgFunction be any Function, then

const permission = new iam.AnyPrincipal()
    .withConditions({
        StringEquals: {
            'aws:PrincipalOrgID': config.organizations.orgId[props.stage]
        }
    });

orgFunction.grantInvoke(permission);

What did you expect to happen?

Expected the CDK synthesis to be successful

What actually happened?

Error: PrincipalWithConditions had unsupported conditions for Lambda permission statement: [{"operator":"StringEquals","key":"aws:PrincipalOrgID"}]. Supported operator/condition pairs: [{"operator":"ArnLike","key":"aws:SourceArn"},{"operator":"StringEquals","key":"aws:SourceAccount"}]

CDK CLI Version

Don't use the CDK CLI

Framework Version

1.149.0

Node.js Version

14.x

OS

Amazon Linux 2 x86_64

Language

Typescript

Language Version

Typescript (3.9.10)

Other information

grantInvoke calls addPermission which calls parsePermissionPrincipal and parseConditions.

parsePermissionsPrincipal should allow an
OrganizationPrincipal and parseConditions should allow the principal condition { operator: 'StringEquals', key: 'aws:PrincipalOrgID' } to conform to the AddPermission functionality presented here, linked earlier.