E3003 on missing SourceAccount when SourceArn is specified using !Sub

[impliedfeline]

CloudFormation Lint Version

1.9.1

What operating system are you using?

WSL Ubuntu 22.04.4 LTS

Describe the bug

In an AWS::Lambda::Permission resource, when specifying SourceArn using !Sub (see attached repro template), cfn-lint complains about missing SourceAccount:

$ cfn-lint -t linttest.yml
E3003 'SourceAccount' is a required property
linttest.yml:27:5

Whereas when using !GetAtt, (!GetAtt HelloLambdaSchedule.Arn), we get no error.

Expected behavior

My understanding is that when SourceArn is specified, SourceAccount isn't strictly required. I found this issue #2155 for which a warning was added in case the SourceAccount is missing, but that's not firing in this case. In this case when SourceArn is specified using !Sub, I would expect either a warning about the usage of !Sub in case that's not guaranteed to provide the account information, or alternatively a warning (instead of an error) about a possibly missing SourceAccount

Reproduction template

Resources:

  HelloLambdaFunction:
    Type: AWS::Lambda::Function
    Properties:
      FunctionName: HelloLambdaFunction
      Role: arn:aws:iam::123456789012:role/lambda-role
      Runtime: python3.12
      Handler: index.my_handler
      Code:
        ZipFile: |
          def my_handler(event, context):
            message = 'Hello Lambda World!'
            return message

  HelloLambdaSchedule:
    Type: "AWS::Events::Rule"
    Properties:
      ScheduleExpression: 'cron(0 4 * * ? *)'
      State: ENABLED
      Targets:
        - Arn: !GetAtt HelloLambdaFunction.Arn
          Id: LambdaSchedule

  HelloLambdaPermission:
    Type: "AWS::Lambda::Permission"
    Properties:
      Action: 'lambda:InvokeFunction'
      FunctionName: HelloLambdaFunction
      Principal: 'events.amazonaws.com'
      SourceArn: !Sub ${HelloLambdaSchedule.Arn}

[kimsappi]

This is supported by the CloudFormation documentation (i.e. it's not a "Required" property): https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-permission.html#cfn-lambda-permission-sourceaccount

This should likely be reported as W3663 instead (if even then), which was introduced in 1.9.0. https://github.com/aws-cloudformation/cfn-lint/releases/tag/v1.9.0

But even that is specified in cfn-lint documentation as "When configuration a Lambda permission with a SourceArn that doesn't have an AccountId you should also specify the SourceAccount". So if SourceArn includes the account ID, even W3663 shouldn't be necessary.

[kddejong]

To many adventures with Fn::Sub so we will remove validation if we run into a Sub. Also fixed the issue where the wrong error number was returned so this will become a warning.