title: Cross-account access to invoke AWS lambda in CDK
body: <p>This is how I am granting an external AWS account invoke permissions on my lambda. </p>
  
  <pre><code>    myLambda.grantInvoke(new iam.AccountPrincipal('account_id_b'));
  </code></pre>
  
  <p>Ran <em>cdk deploy</em></p>
  
  <p><em>Resource-based policy</em> has the following json as seen in the console</p>
  
  <pre><code>{
    "Version": "2012-10-17",
    "Id": "default",
    "Statement": [
      {
        "Sid": "generated_Sid",
        "Effect": "Allow",
        "Principal": {
          "AWS": "arn:aws:iam::account_id_b:root"
        },
        "Action": "lambda:InvokeFunction",
        "Resource": "my_lambda_arn"
      }
    ]
  }
  </code></pre>
  
  <p>I followed steps here <a href="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-cross-account-lambda-integrations.html" rel="nofollow noreferrer">https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-cross-account-lambda-integrations.html</a> to create API gateway that can call this lambda from account_id_b account.</p>
  
  <p>Testing API gateway from account_id_b results in following logs:</p>
  
  <pre><code>Fri Mar 06 03:00:07 UTC 2020 : Execution failed due to configuration error: Invalid permissions on Lambda function
  Fri Mar 06 03:00:07 UTC 2020 : Method completed with status: 500
  </code></pre>
  
  <p>What additionally do I need to do to set this up properly?</p>