Describe the bug

While upgrading from 1.140.0 to 2.20.0, we noticed that the behavior of aws_lambda.Function.grant_invoke has changed. Previously it granted lambda:InvokeFunction just on the function ARN itself. Now it also grants lambda:InvokeFunction on ${arn}:*, meaning all function versions.

This change does not make sense. At best, granting this wildcard permission is pointless, because CDK doesn't publish function versions. At worst, this is actually a potential security issue, because when I grant invoke rights to a principal, I mean for them to invoke it without any version number, which means $LATEST. If they have permission to invoke any version, then it is possible for them to invoke an older version that is not intended to be used anymore.

Expected Behavior

grant_invoke should retain its original behavior of only granting the ability to invoke the function itself, without an explicit version. If for some reason someone wants to grant wildcard access to all versions, there can be an optional boolean parameter to grant_invoke.

Current Behavior

See above.

Reproduction Steps

Create an aws_lambda.Function and use grant_invoke to grant invoke rights to some principal. Then look at the IAM policy that is generated.

Possible Solution

No response

Additional Information/Context

No response

CDK CLI Version

2.20.0

Framework Version

No response

Node.js Version

16.14.2

OS

Alpine 3.15

Language

Python

Language Version

3.9.12

Other information

No response