Fix public lambdas and sites returning 403 on new AWS accounts (#6400)

* add invoke function permission to public lambdas

* fix 403 public lambdas for oac modes

* only apply if url auth is `"none"`

Author: vimtor

platform/src/components/aws/function.ts

@@ -2509,6 +2509,17 @@ export class Function extends Component implements Link.Linkable {
           },
           { parent },
         );
+        if (url.authorization === "none") {
+          new lambda.Permission(
+            `${name}InvokeFunction`,
+            {
+              action: "lambda:InvokeFunction",
+              function: fn.name,
+              principal: "*",
+            },
+            { parent },
+          );
+        }
         if (!url.route) return fnUrl.functionUrl;
 
         // add router route

platform/src/components/aws/ssr-site.ts

@@ -1064,6 +1064,16 @@ async function handler(event) {
               },
               { provider, parent: self },
             );
+            new lambda.Permission(
+              `${name}CloudFrontInvokeFunction${logicalName(region)}`,
+              {
+                action: "lambda:InvokeFunction",
+                function: server.nodes.function.name,
+                principal: "cloudfront.amazonaws.com",
+                sourceArn: dist.nodes.distribution.arn,
+              },
+              { provider, parent: self },
+            );
           }
         });
 
@@ -1094,6 +1104,16 @@ async function handler(event) {
               },
               { parent: self },
             );
+            new lambda.Permission(
+              `${name}ImageOptimizerCloudFrontInvokeFunction`,
+              {
+                action: "lambda:InvokeFunction",
+                function: imgOptimizer.nodes.function.name,
+                principal: "cloudfront.amazonaws.com",
+                sourceArn: dist.nodes.distribution.arn,
+              },
+              { parent: self },
+            );
           }
         }
       },