title: unable to trigger lambda with event bridge on aws using pulumi
body: <p>using pulumi I have created</p>
  <ul>
  <li>a lambda with a docker image.</li>
  <li>a event bridge rule</li>
  <li>added the event bridge rule as a trigger to lambda.</li>
  </ul>
  <p>code for pulumi <strong>main</strong>.py file is as follows:</p>
  <pre><code>import json
  import base64
  import pulumi
  from pulumi_aws.cloudwatch import event_target
  from pulumi_aws.ecr import repository
  import pulumi_docker as docker
  from pulumi_aws import ecs, ecr, lambda_, cloudwatch, iam
  
  # project name
  project_name = 'pulumi-event-trigger'
  
  repo = ecr.Repository(
      resource_name = '{project_name}-lambda'.format(project_name=project_name),
      image_scanning_configuration = ecr.RepositoryImageScanningConfigurationArgs(
          scan_on_push = True
      ),
      name = '{project_name}-lambda'.format(project_name=project_name)
  )
  
  repo_lifecycle_policy = ecr.LifecyclePolicy(
      resource_name = '{project_name}-repository-policy'.format(project_name=project_name),
      repository = repo.name,
      policy = {
          'rules': [
              {
                  &quot;rulePriority&quot;: 1,
                  &quot;description&quot;: &quot;Expire images older than 14 days&quot;,
                  &quot;selection&quot;: {
                      &quot;tagStatus&quot;: &quot;untagged&quot;,
                      &quot;countType&quot;: &quot;sinceImagePushed&quot;,
                      &quot;countUnit&quot;: &quot;days&quot;,
                      &quot;countNumber&quot;: 14
                  },
                  &quot;action&quot;: {
                      &quot;type&quot;: &quot;expire&quot;
                  }
              }
          ]
      }
  )
  
  def get_registry_info(rid):
      creds = ecr.get_credentials(registry_id=rid)
      decoded = base64.b64decode(creds.authorization_token).decode()
      parts = decoded.split(':')
      if len(parts) != 2:
          raise Exception(&quot;Invalid credentials&quot;)
      return docker.ImageRegistry(creds.proxy_endpoint, parts[0], parts[1])
  
  image = docker.Image(
      name = '{project_name}-image'.format(project_name=project_name),
      image_name = repo.repository_url,
      build = './',
      skip_push = False,
      registry = repo.registry_id.apply(get_registry_info)
  )
  
  # iam role
  lambda_role = iam.Role(
      resource_name = '{project_name}-lambda-role'.format(project_name=project_name),
      assume_role_policy = json.dumps({
          &quot;Version&quot;: &quot;2012-10-17&quot;,
          &quot;Statement&quot;: [
              {
                  &quot;Action&quot;: &quot;sts:AssumeRole&quot;,
                  &quot;Principal&quot;: {
                      &quot;Service&quot;: &quot;lambda.amazonaws.com&quot;
                  },
                  &quot;Effect&quot;: &quot;Allow&quot;,
                  &quot;Sid&quot;: &quot;&quot;
              }
          ]
      })
  )
  
  lambda_policy = iam.RolePolicyAttachment(
      resource_name = '{project_name}-lambda-policy'.format(project_name=project_name),
      role = lambda_role.name,
      policy_arn = iam.ManagedPolicy.LAMBDA_FULL_ACCESS
  )
  
  cloudwatch_policy = iam.RolePolicyAttachment(
      resource_name = '{project_name}-lambda-cloudwatch-policy'.format(project_name=project_name),
      role = lambda_role.name,
      policy_arn = iam.ManagedPolicy.CLOUD_WATCH_FULL_ACCESS
  )
  
  ecs_policy = iam.RolePolicyAttachment(
      resource_name = '{project_name}-lambda-ecs-policy'.format(project_name=project_name),
      role = lambda_role.name,
      policy_arn = iam.ManagedPolicy.AMAZON_ECS_FULL_ACCESS
  )
  
  lambda_log = cloudwatch.LogGroup(
      resource_name = '{project_name}-log-group'.format(project_name=project_name),
      retention_in_days = 14,
      name = '{project_name}-logs'.format(project_name=project_name)
  )
  
  lambda_function = lambda_.Function(
      resource_name = '{project_name}-function'.format(project_name=project_name),
      package_type = 'Image',
      image_uri = image.image_name,
      timeout = 60,
      role = lambda_role.arn
  )
  
  event_role = iam.Role(
      resource_name = '{project_name}-event-role'.format(project_name=project_name),
      assume_role_policy = json.dumps({
          &quot;Version&quot;: &quot;2012-10-17&quot;,
          &quot;Statement&quot;: [
              {
                  &quot;Action&quot;: &quot;sts:AssumeRole&quot;,
                  &quot;Principal&quot;: {
                      &quot;Service&quot;: &quot;lambda.amazonaws.com&quot;
                  },
                  &quot;Effect&quot;: &quot;Allow&quot;,
                  &quot;Sid&quot;: &quot;&quot;
              },
              {
                  &quot;Action&quot;: &quot;sts:AssumeRole&quot;,
                  &quot;Principal&quot;: {
                      &quot;Service&quot;: &quot;events.amazonaws.com&quot;
                  },
                  &quot;Effect&quot;: &quot;Allow&quot;,
                  &quot;Sid&quot;: &quot;&quot;
              }
          ]
      })
  )
  
  event_lambda = iam.RolePolicyAttachment(
      resource_name = '{project_name}-lambda-event-policy',
      role = event_role.name,
      policy_arn = iam.ManagedPolicy.LAMBDA_FULL_ACCESS
  )
  
  event_cloudwatch = iam.RolePolicyAttachment(
      resource_name = '{project_name}-cloudwatch-event-policy',
      role = event_role.name,
      policy_arn = iam.ManagedPolicy.CLOUD_WATCH_EVENTS_FULL_ACCESS
  )
  
  event_rule = cloudwatch.EventRule(
      resource_name = '{project_name}-event-rule'.format(project_name=project_name),
      role_arn = event_role.arn,
      schedule_expression = 'cron(0 12 * * ? *)'
  )
  
  event_target = cloudwatch.EventTarget(
      resource_name = '{project_name}-event-target'.format(project_name=project_name),
      role_arn = event_role.arn,
      rule = event_rule.name,
      arn = lambda_function.arn
  )%    
  </code></pre>
  <p>when trying pulumi up I get an error for event target :</p>
  <pre><code>  aws:cloudwatch:EventTarget (pulumi-event-trigger-event-target):
      error: 1 error occurred:
          * Creating CloudWatch Events Target failed: ValidationException: RoleArn is not supported for target arn:aws:lambda:us-west-2:575470212210:function:pulumi-event-trigger-function-f015137.
          status code: 400, request id: f28eedde-9a2b-49bd-a5e6-dedbb846d25a
  </code></pre>
  <p>event bridge rule is not able to register as a target for the lambda.
  issue is just with these last lines:</p>
  <pre><code>event_target = cloudwatch.EventTarget(
      resource_name = '{project_name}-event-target'.format(project_name=project_name),
      role_arn = event_role.arn,
      rule = event_rule.name,
      arn = lambda_function.arn
  )%  
  </code></pre>
  <p>here is some documentation also by pulumi on same :
  <a href="https://www.pulumi.com/docs/reference/pkg/aws/cloudwatch/eventtarget/" rel="nofollow noreferrer">pulumi documentation on event target</a></p>
  <p>pulumi docs example: (only parameter I am not passing is run_command as my lambda is a docker image)</p>
  <pre><code>stop_instances_event_target = aws.cloudwatch.EventTarget(&quot;stopInstancesEventTarget&quot;,
      arn=stop_instance.arn,
      rule=stop_instances_event_rule.name,
      role_arn=ssm_lifecycle_role.arn,
      run_command_targets=[aws.cloudwatch.EventTargetRunCommandTargetArgs(
          key=&quot;tag:Terminate&quot;,
          values=[&quot;midnight&quot;],
      )])
  </code></pre>