Need help using Annotation to ack an error with a lambda

Question

Here is the warning:

> [Warning at /CoreStack/S3Resources/FactsetNewDocumentLambda] addPermission() has no effect on a Lambda Function with region=us-east-1, account=471112525756, in a Stack with region=us-east-1, account=362454057537. Suppress this warning if this is is intentional, or pass sameEnvironment=true to fromFunctionAttributes() if you would like to add the permissions. [ack: UnclearLambdaEnvironment]

Here is the code:

```
 // The following somehow produces an attempt to addPermission to the lambda, which fails,
    // because it lives in another account. All the permissions are set up in the environment
    // where it is created.
    const stagingLambda = aws_lambda.Function.fromFunctionArn(
      this,
      "FactsetNewDocumentLambda",
      "arn:aws:lambda:us-east-1:471112525756:function:FactsetNewDocumentHandler",
    );
    Annotations.of(stagingLambda).acknowledgeWarning(
      "UnclearLambdaEnvironment",
      "This warning is intentional and reviewed.",
    );

```

The annotation is not suppressing the warning.

bimargulies · Answer

Here is the correct code:

```
    const stagingLambda = aws_lambda.Function.fromFunctionAttributes(
      this,
      "MyLambda",
      {
        functionArn:
          "arn:aws:lambda:us-east-1:aaaaaaaaaaaa:function:nnnnnnnnnnnn",
        skipPermissions: true,
      },
    );
```

re:Post Agent · Answer

The warning you're seeing is related to cross-account Lambda permissions. When you use `Function.fromFunctionArn()` to reference a Lambda function in another AWS account, the CDK tries to add permissions to that function but can't because it's in a different account.

Your annotation isn't working because you need to use the correct warning ID format. The warning ID "UnclearLambdaEnvironment" doesn't match the actual ID in the warning message.

To properly suppress this warning, you should modify your code to either:

1. Use the exact warning ID as shown in the message:
```
Annotations.of(stagingLambda).acknowledgeWarning(
"addPermission() has no effect on a Lambda Function with region=us-east-1, account=471112525756, in a Stack with region=us-east-1, account=362454057537",
"This warning is intentional and reviewed."
);
```

Or, a better approach would be to:

2. Pass the `sameEnvironment: false` parameter when creating the function reference:
```
const stagingLambda = aws_lambda.Function.fromFunctionArn(
this,
"FactsetNewDocumentLambda",
"arn:aws:lambda:us-east-1:471112525756:function:FactsetNewDocumentHandler",
{ sameEnvironment: false }
);
```

This explicitly tells CDK that the Lambda function is in a different environment and not to attempt adding permissions to it.  
**Sources**  
[Config rule with custom lambda permission issue | AWS re:Post](https://repost.aws/questions/QU3iV0TvAdTD6aYjRtZ_sW1g/config-rule-with-custom-lambda-permission-issue)  
[Granting Lambda function access to other accounts - AWS Lambda](https://docs.aws.amazon.com/lambda/latest/dg/permissions-function-cross-account.html)  
[Lambda examples using AWS CLI - AWS SDK Code Examples](https://docs.aws.amazon.com/code-library/latest/ug/cli_2_lambda_code_examples.html)

Need help using Annotation to ack an error with a lambda

Add your answer

Relevant content