When a Lambda function is registered as a target group in an Application Load Balancer it adds a AWS::Lambda::Permission allowing the Principal: elasticloadbalancing.amazonaws.com to invoke the function.

However, the Target group does not contain a dependency on this permission and due to order of creation might fail if CloudFormation decides to create the TargetGroup before the Lambda permission.

Reproduction Steps

alb = ApplicationLoadBalancer(...)
listener = alb.add_listener("Listener", port=80, open=False)
lambda_function = Function(...)
listener.add_targets(
            "Target",
            targets=[LambdaTarget(lambda_function)],
            priority=1,
        )

Error Log

From the CloudFormation console:

API: elasticloadbalancingv2:RegisterTargets elasticloadbalancing principal does not have permission to invoke arn:aws:lambda:us-west-2:********:function:LambdaFunctionF38095AF-1BKXQUR0FWO9P from target group arn:aws:elasticloadbalancing:us-west-2:***********:targetgroup/LambdaFunction6BJ8GFZ2AFNJ/40d175d269b48dec

Environment

• **CLI Version :1.14.0
• **Framework Version:1.14.0
• **OS :N/A
• **Language :English

Other

This is 🐛 Bug Report