{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "Principal": {
        "AWS": "*"
      },
      "Action": "lambda:*",
      "Resource": "arn:aws:lambda:<region>:<account-id>:function:<function-name>",
      "Condition": {
        "ArnNotEquals": {
          "aws:SourceArn": "arn:aws:logs:<region>:<account-id>:log-group:/aws/lambda/<function-name>:*"
        }
      }
    }
  ]
}

# Lambda permission resource controlling cross-account access to the function.
# REMEDIATION: Remove or modify any aws_lambda_permission that grants access
# to untrusted accounts; Terraform will then delete that statement from the
# Lambda resource-based policy.

resource "aws_lambda_permission" "allow_trusted_account" {
  statement_id  = "ALLOW_TRUSTED_ACCOUNT" # Must be unique per function
  action        = "lambda:InvokeFunction"
  function_name = aws_lambda_function.MY_FUNCTION.function_name

  # Replace TRUSTED_ACCOUNT_ID with the AWS account ID you actually want to allow.
  principal = "arn:aws:iam::TRUSTED_ACCOUNT_ID:root"

  # Optionally scope further (e.g., to a specific source account or ARN)
  # source_account = "TRUSTED_ACCOUNT_ID"
  # source_arn     = "arn:aws:events:REGION:TRUSTED_ACCOUNT_ID:rule/MY_RULE"
}

resource "aws_lambda_function" "MY_FUNCTION" {
  function_name = "MY_FUNCTION_NAME" # replace with your function name
  role          = aws_iam_role.LAMBDA_EXEC_ROLE.arn
  handler       = "index.handler"
  runtime       = "nodejs20.x"

  filename         = "PATH_TO_PACKAGE_ZIP"
  source_code_hash = filebase64sha256("PATH_TO_PACKAGE_ZIP")
}

# Any existing aws_lambda_permission resources that reference untrusted
# principals (for example an external account ID) must be deleted from
# Terraform or their `principal` changed to a trusted account/organization.
# Removing that resource from configuration will cause Terraform to call
# `RemovePermission` for its `statement_id`, matching the CLI remediation.
#
# WARNING: Removing a permission may impact legitimate cross-account
# integrations. Verify that the access is unauthorized before deleting or
# changing a permission block.

# Example of a permission that should be REMOVED from Terraform to remediate:
# resource "aws_lambda_permission" "allow_untrusted_account" {
#   statement_id  = "ALLOW_UNTRUSTED_ACCOUNT"
#   action        = "lambda:InvokeFunction"
#   function_name = aws_lambda_function.MY_FUNCTION.function_name
#   principal     = "arn:aws:iam::UNTRUSTED_ACCOUNT_ID:root"
# }