# Buggy code
def add(self, func):
    rule = self.get(func.name)
    params = self.get_rule_params(func)

    if rule and self.delta(rule, params):
        log.debug("Updating config rule for %s" % self)
        rule.update(params)
        return self.client.put_config_rule(ConfigRule=rule)
    elif rule:
        log.debug("Config rule up to date")
        return
    client = self.session.client("lambda")
    try:
        client.add_permission(
            FunctionName=func.name,
            StatementId=func.name,
            SourceAccount=func.arn.split(":")[4],
            Action="lambda:InvokeFunction",
            Principal="config.amazonaws.com",
        )
    except client.exceptions.ResourceConflictException:
        pass

    log.debug("Adding config rule for %s" % func.name)
    return self.client.put_config_rule(ConfigRule=params)


# Traceback (InsufficientPermissionsException)
2019-08-08 16:03:56,496: custodian.policy:INFO Provisioning policy lambda cross-account-rds-snapshot
2019-08-08 16:03:58,918: custodian.policy:INFO Provisioning policy lambda cross-account-lambda
2019-08-08 16:04:02,008: custodian.output:ERROR Error while executing policy
Traceback (most recent call last):
File "/Library/Python/2.7/site-packages/c7n/policy.py", line 497, in provision
role=self.policy.options.assume_role)
File "/Library/Python/2.7/site-packages/c7n/mu.py", line 309, in publish
if e.add(func):
File "/Library/Python/2.7/site-packages/c7n/mu.py", line 1543, in add
return self.client.put_config_rule(ConfigRule=params)
File "/Users/varun.tomar/Library/Python/2.7/lib/python/site-packages/botocore/client.py", line 357, in _api_call
return self._make_api_call(operation_name, kwargs)
File "/Users/varun.tomar/Library/Python/2.7/lib/python/site-packages/botocore/client.py", line 661, in _make_api_call
raise error_class(parsed_response, operation_name)
InsufficientPermissionsException: An error occurred (InsufficientPermissionsException) when calling the PutConfigRule operation: The AWS Lambda function arn:aws:lambda:us-east-2:xxxxxxxxx:function:custodian-cross-account-lambda cannot be invoked. Check the specified function ARN, and check the function's permissions.
Traceback (most recent call last):
File "/Library/Python/2.7/site-packages/c7n/cli.py", line 368, in main
command(config)
File "/Library/Python/2.7/site-packages/c7n/commands.py", line 136, in _load_policies
return f(options, list(policies))
File "/Library/Python/2.7/site-packages/c7n/commands.py", line 268, in run
policy()
File "/Library/Python/2.7/site-packages/c7n/policy.py", line 945, in __call__
resources = mode.provision()
File "/Library/Python/2.7/site-packages/c7n/policy.py", line 497, in provision
role=self.policy.options.assume_role)
File "/Library/Python/2.7/site-packages/c7n/mu.py", line 309, in publish
if e.add(func):
File "/Library/Python/2.7/site-packages/c7n/mu.py", line 1543, in add
return self.client.put_config_rule(ConfigRule=params)
File "/Users/varun.tomar/Library/Python/2.7/lib/python/site-packages/botocore/client.py", line 357, in _api_call
return self._make_api_call(operation_name, kwargs)
File "/Users/varun.tomar/Library/Python/2.7/lib/python/site-packages/botocore/client.py", line 661, in _make_api_call
raise error_class(parsed_response, operation_name)
InsufficientPermissionsException: An error occurred (InsufficientPermissionsException) when calling the PutConfigRule operation: The AWS Lambda function arn:aws:lambda:us-east-2:xxxxxxxxxxx:function:custodian-cross-account-lambda cannot be invoked. Check the specified function ARN, and check the function's permissions.
/Users/varun.tomar/Library/Python/2.7/lib/python/site-packages/botocore/client.py(661)_make_api_call()
-> raise error_class(parsed_response, operation_name)
(Pdb) Traceback (most recent call last):
File "/usr/local/bin/custodian", line 9, in <module>
load_entry_point('c7n==0.8.43.1', 'console_scripts', 'custodian')()
File "/Library/Python/2.7/site-packages/c7n/cli.py", line 373, in main
pdb.post_mortem(sys.exc_info()[-1])
File "/System/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/pdb.py", line 1267, in post_mortem
p.interaction(None, t)
File "/System/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/pdb.py", line 210, in interaction
self.cmdloop()
File "/System/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/cmd.py", line 130, in cmdloop
line = raw_input(self.prompt)
KeyboardInterrupt

# Fixed code
def add(self, func):
    rule = self.get(func.name)
    params = self.get_rule_params(func)

    if rule and self.delta(rule, params):
        log.debug("Updating config rule for %s" % self)
        rule.update(params)
        return LambdaRetry(self.client.put_config_rule, ConfigRule=rule)
    elif rule:
        log.debug("Config rule up to date")
        return
    client = self.session.client("lambda")
    try:
        client.add_permission(
            FunctionName=func.name,
            StatementId=func.name,
            SourceAccount=func.arn.split(":")[4],
            Action="lambda:InvokeFunction",
            Principal="config.amazonaws.com",
        )
    except client.exceptions.ResourceConflictException:
        pass

    log.debug("Adding config rule for %s" % func.name)
    return LambdaRetry(self.client.put_config_rule, ConfigRule=params)