Lambda Permission discrepancies between CDK and Console

[baciuand]

Hi all,

Context:

• We're building a cross-account lambda authorizer (for API Gateway). The lambda authorizer (inside account 111111111111) will need give permissions to the client aws accounts (i.e. account 222222222222, 333333333333) or source ARN (i.e. arn:aws:execute-api:us-east-1:222222222222:API_ID/authorizers/AUTHORIZER_ID ) in order for the clients to be able to call the lambda.

Problem statement:

• Currently, the AWS console doesn't have a JSON editor for the lambda permissions, so we don't have the freedom to use all the options we can use with CDK. With CDK, we can use Permission.sourceAccount(permission.ts in aws-cdk-lib 2.14.0), and this is not possible with the console.

Our questions:

• Are we free to use what CDK provides us, or should we stick to the limited options that the AWS console provides us?
• If we decide to use Permission.sourceAccount, which is not "allowed" in the AWS console, are we at risk of facing unexpected behaviors from AWS?
• If we decide to use Permission.sourceAccount, which is not "allowed" in the AWS console, are we at risk of not being able to update our CDK version because of backwards compatibility issues (in future CDK versions)?