Modify trust relationship of existing role using cdk - java

[chachads]

I am new to CDK. Using Java CDK to add a Lambda. Goal is to add an Eventbridge.Scheduler to trigger the Lambda. For this I need to add sts:AssumeRole in trust relationship for the Lambda Role. How can I do that?

Here is my code:

Function lambda =  new Function(dataPipeStack, functionName, FunctionProps.builder()
.runtime(Runtime.JAVA_11)
.code(Code.fromBucket(b,"mydata-1.0.jar",processingLambdaCodeVersion))
.handler("lambdas.ExampleLambda")
.memorySize(1024)
.timeout(Duration.seconds(30))
.environment(environmentVariables)
.build());
IRole lambdaExecutionRole = lambda.getRole();

So lambdaExecutionRole is the IAM role CDK creates. I tried

lambdaExecutionRole.grant(new ServicePrincipal("scheduler.amazonaws.com"),"sts:AssumeRole");
lambdaExecutionRole.grantAssumeRole(new ServicePrincipal("scheduler.amazonaws.com"));

Also tried creating a PolicyStatement

    PolicyStatement ps = new PolicyStatement();
    ps.setEffect(Effect.ALLOW);
    ps.addServicePrincipal("scheduler.amazonaws.com");
    ps.addActions("sts:AssumeRole");
    lambdaExecutionRole.addToPrincipalPolicy(ps);

What I am missing?

[indrora]

You have your order of operations incorrect.

Create the role that you wish to use for the Lambda function first. Add the requisite service principal information. Then pass that to the lambda function builder.

[github-actions[bot]]

Hello! Reopening this discussion to make it searchable.