@aws-cdk/aws-iot: Add an option for CfnTopicRule to automatically create CfnPermission to invoke Lambda Function

[olivierpichon]

When creating a TopicRule that should call a AWS Lambda, all the resources are correctly created without error.
However the lambda function is never invoked. On the AWS console, when going into the created topic rule, click edit and then just update is enough to "fix" the problem:

After a lot of digging, a CfnPermission appear to be needed for the lambda function to be invoked. The error is otherwise not surfaced to the end user. This problem was faced already and logged here for example: #12772
But because of the absence of error, the source of the problem could not be identified, even by the CDK team. This is of course not a CDK bug though, one would face the same problem using Cloudformation.

Proposed Solution

As CDK's main role and philosophy is to ship with sensible default, I would suggest to have an option when creating a CfnTopicRule which would automatically create the right CfnPermission under the hood.

E.g, something like this (a withCfnPermission attribute):

new CfnTopicRule(this, "TelemetryIngestion", {
      ruleName: 'TelemetryIngestion',
      topicRulePayload: {
        sql: "SELECT time, topic(2) as site_id, topic(3) AS device_type, topic(4) AS device_id, topic(5) AS endpoint, value FROM 'dt/+/+/+/#'",
        ruleDisabled: false,
        awsIotSqlVersion: '2016-03-23',
        actions: [
          {
            lambda: { functionArn: fn.functionArn, withCfnPermission: true }
          }
        ]
      }
    })

Thanks a lot for consideration and for the great work!

[jumic]

Some additional information:

The Lambda documentation describes that this permission has to be added when a Lambda function is used with AWS IoT.

Feature request #5420 already requests to add the generation of this permission in CDK.

Furthermore, pull request #13581 contains a L2 Construct that implements the necessary permission automatically. Currently, this feature request is labeled as P2, therefore it's a good idea to react with +1 to this PR which will help the CDK team to priorize the PR.

[yamatatsu]

This is resolved by #17110 😃

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.