title: Lambda@Edge through Go SDK
body: <p>I am trying to associate a Lambda@Edge Function using the AWS Go SDK.</p>
  
  <ol>
  <li><p>Creating the Function by hand in the console <strong>and</strong> assigning it to the Cloudfront distro using the SDK => <strong>works</strong>. </p></li>
  <li><p>Creating the Function (using the same IAM role from 1.) in the code w/o assigning to cloudfront => <strong>works</strong>.</p></li>
  <li><p>Assigning the created function from 2. by hand in the console => <strong>fails</strong>.</p></li>
  <li><p>Assigning the created function from 2. via the SDK => <strong>fails</strong>.</p></li>
  <li><p>Deploying the created function from 2. by hand in the lambda console (Actions => deploy to lambda@edge) => <strong>works</strong>. => after this the function can be assigned by hand and by code w/o problems...</p></li>
  </ol>
  
  <p>The error in 3. and 4. is the same:</p>
  
  <pre><code>InvalidLambdaFunctionAssociation: Lambda@Edge cannot retrieve the specified Lambda function. Update the IAM policy to add permission: lambda:GetFunction for resource: arn:aws:lambda:us-east-1:123456789:function:example:1 and try again.
  </code></pre>
  
  <p>What confuses me is that I am reusing the same role that was created during 1. </p>
  
  <p>This is how I create the function by code:</p>
  
  <pre><code>lam := lambda.New(session)
  lam.CreateFunction(&amp;lambda.CreateFunctionInput{
      FunctionName: aws.String("example"),
      Handler:      aws.String("index.handler"),
      Runtime:      aws.String("nodejs12.x"),
      Role:         aws.String("arn:aws:iam::123456:role/service-role/existing-role"),
      Code: &amp;lambda.FunctionCode{
          S3Bucket: aws.String("bucket-xyz"),
          S3Key:    aws.String("source.zip"),
      },
  }) // works w/o issues
  
  lam.AddPermission(&amp;lambda.AddPermissionInput{
      FunctionName: aws.String("example"),
      StatementId:  aws.String("AllowExecutionFromCloudFront"),
      SourceArn:    aws.String("arn:aws:cloudfront::12333456:distribution/CDNID1234"),
      Principal:    aws.String("edgelambda.amazonaws.com"),
      Action:       aws.String("lambda:GetFunction"),
  }) // also works w/o error
  
  // assigning the created lambda function would now fail
  </code></pre>
  
  <p>using</p>
  
  <p>go 1.13</p>
  
  <p>github.com/aws/aws-sdk-go v1.31.8</p>