lib/plugins/aws/customResources/resources/cognitoUserPool/lib/permissions.js/addPermission
function addPermission(config) {
  const { functionName, userPoolName, region, accountId, userPoolId } = config;
  const lambda = new Lambda({ region });
  const partition = region && /^cn-/.test(region) ? 'aws-cn' : 'aws';
  const params = {
    Action: 'lambda:InvokeFunction',
    FunctionName: functionName,
    Principal: 'cognito-idp.amazonaws.com',
    StatementId: getStatementId(functionName, userPoolName),
    SourceArn: `arn:${partition}:cognito-idp:${region}:${accountId}:userpool/${userPoolId}`,
  };
  return lambda.addPermission(params).promise();
}