# Possible bug in EventBridge Lambda resource-based policy deployment

**URL:** <https://forum.serverless.com/t/possible-bug-in-eventbridge-lambda-resource-based-policy-deployment/13815>\
**Category:** Serverless Framework\
**Created:** [January 20, 2021, 7:45pm UTC](https://forum.serverless.com/t/possible-bug-in-eventbridge-lambda-resource-based-policy-deployment/13815 "2021-01-20T19:45:26Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![julianotebinka](https://avatars.discourse-cdn.com/v4/letter/j/6de8d8/32.png) [@julianotebinka](https://forum.serverless.com/u/julianotebinka)\
**Post date:** [January 20, 2021, 7:45pm UTC](https://forum.serverless.com/t/possible-bug-in-eventbridge-lambda-resource-based-policy-deployment/13815/1 "2021-01-20T19:45:27Z")

</div>

When deploying a function that is triggered by an EventBridge event, Serverless framework define a resource-based policy that allows that EventBridge rule to trigger this particular function. Example below:

```auto
  "Version": "2012-10-17",
  "Id": "default",
  "Statement": [
    {
      "Sid": "validation-api-dev-handleNewValidationNeededEvent-validation-api-dev-handlenewvalidationneededevent-",
      "Effect": "Allow",
      "Principal": {
        "Service": "events.amazonaws.com"
      },
      "Action": "lambda:InvokeFunction",
      "Resource": "arn:aws:lambda:us-east-1:{{account_id}}:function:validation-api-dev-handleNewValidationNeededEvent",
      "Condition": {
        "ArnLike": {
          "AWS:SourceArn": "arn:aws:events:us-east-1:{{account_id}}:rule/dev-validations/validation-api-dev-handleNewValidationNeededEvent-rule-1"
        }
      }
    }
  ]
}

```

It works very well when the function and the EventBridge queue definition sits under the same application.

However when the event bus is in a different serverless app it looks like Serverless framework has a bug when setting the AWS:SourceArn. It mistakenly sets the source ARN (that is in another service) with the target service. For example:  
Correct rule ARN: arn:aws:events:us-east-1:{{account\_id}}:rule/ **dev-applications** /validation-api-dev-handleNewApplicationEvent-rule-1  
ARN considered by sls: arn:aws:events:us-east-1:{{account\_id}}:rule/ **dev-validations** /validation-api-dev-handleNewApplicationEvent-rule-1

Note the confusion made by sls with the service names: dev-applications is where the event bus/rule is deployed, dev-validations is where it’s being used.

For the time being I fixed this by manually adding this permission via CLI to that particular lambda.

Any help on that?