title: Way to give many principals Invocation permissions to a lambda
body: <p>I have a lambda that will need access to more than 1 principal so I'm looking for ways to create all necessary invocation permissions in a CloudFormation template.</p>
  
  <p>For example Accounts 123 and 456 will need access to MyFunction so something like this will <strong>not</strong> work:</p>
  
  <pre><code>Resources:
    LambdaInvokePermission:
      Type: AWS::Lambda::Permission
      Properties:
        FunctionName: arn:aws:lambda:us-west-2:${AWS::AccountId}:MyFunction
        Action: lambda:InvokeFunction          
        Principal: "123,456"
  </code></pre>
  
  <p>...and it will not work because the <a href="http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-permission.html" rel="nofollow noreferrer">documentation</a> says that it only accepts string so I thought that maybe passing a <em>CommaDelimitedList</em> parameter to the CloudFormation template and using a Fn:Join could do the job. Something like this:</p>
  
  <pre><code>Parameters:
    MyAccounts:
      Description: All accounts
      Type: CommaDelimitedList
  ...
  Resources:
    CrossInvokePermission:
      Type: AWS::Lambda::Permission
      Properties:
        Fn::Join:
          - ""
          - - '{"Principal": {"AWS": ["'
            - Fn::Join: ['","', {Ref: MyAccounts} ]
            - '"]}, "Action": "lambda:InvokeFunction", "FunctionName" : "'
            - arn:aws:lambda:us-west-2:${AWS::AccountId}:function:MyFunction
            - '"}'
  </code></pre>
  
  <p>My question is, is it possible to do what I'm trying? So far my efforts have failed.</p>