lib/plugins/aws/customResources/resources/s3/lib/permissions.js/addPermission
function addPermission(config) {
  const { functionName, bucketName, region } = config;
  const lambda = new AWS.Lambda({ region });
  const partition = region && /^cn-/.test(region) ? 'aws-cn' : 'aws';
  const payload = {
    Action: 'lambda:InvokeFunction',
    FunctionName: functionName,
    Principal: 's3.amazonaws.com',
    StatementId: getStatementId(functionName, bucketName),
    SourceArn: `arn:${partition}:s3:::${bucketName}`,
  };
  return lambda.addPermission(payload).promise();
}