Update lambda permission to include the SourceAccount

[drem-darios]

The lambda permission that gets created should prohibit public access. When setting 'Principal' to a service principal (for example, config.amazonaws.com), provide the 'SourceAccount' field as well.

[bmorrissirromb]

This is a slightly harder problem than it looks like.

Many organizations use cross-account access for their Config-Lambda communication. In these cases, a static SourceAccount field may prevent cross-account use of the Lambda (in this cases, something more like PrincipalOrgID may be more useful).

I think it's a worthy goal, but should be opt-in instead of always-on.

[drem-darios]

I can agree with that. Setting a principal org id on the lambda permission would work well for a multi-account setup like the one in this blog post: https://aws.amazon.com/blogs/mt/aws-config-rdk-multi-account-and-multi-region-deployment/. That way only accounts in the org can invoke the lambda function. I'm not familiar with the repo enough to make a suggestion on how to make this field optional but I support the effort 👍