Amazon LexにCloudFormationでLambda関数を関連付ける場合、リソースベースポリシーも記載が必要です

AWSTemplateFormatVersion: '2010-09-09'
Description: 'Create Lambda, Lex bot, and associate them with Connect instance'

Parameters:
  ConnectInstanceARN:
    Type: String
    Description: The Amazon Resource Name (ARN) of the instance.
  ProjectName:
    Type: String

Resources:
  TestLambdaFunction:
    Type: AWS::Lambda::Function
    Properties:
      FunctionName: !Sub ${ProjectName}-test-lambda
      Handler: index.lambda_handler
      Role: !GetAtt TestLambdaExecutionRole.Arn
      Code:
        ZipFile: |
          ~省略~

      Runtime: python3.12
      MemorySize: 512
      Timeout: 10

  TestLambdaExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub ${ProjectName}-test-lambda-role
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole

  TestLex:
    Type: AWS::Lex::Bot
    Properties:
      Name: !Sub ${ProjectName}-test-lex
      DataPrivacy:
        ChildDirected: false
      IdleSessionTTLInSeconds: 300
      RoleArn: !GetAtt TestLexRole.Arn
      BotLocales:
        - LocaleId: ja_JP
          NluConfidenceThreshold: 0.40
          VoiceSettings:
            VoiceId: Kazuha
          Intents:
            - Name: FallbackIntent
              ParentIntentSignature: AMAZON.FallbackIntent
              DialogCodeHook:
                Enabled: true
            - Name: dummy
              SampleUtterances:
                - Utterance: dummy
              DialogCodeHook:
                Enabled: true

  TestLexVersion1:
    Type: AWS::Lex::BotVersion
    Properties:
      BotId: !Ref TestLex
      BotVersionLocaleSpecification:
        - LocaleId: ja_JP
          BotVersionLocaleDetails:
            SourceBotVersion: DRAFT
  TestLexAlias:
    Type: AWS::Lex::BotAlias
    Properties:
      BotAliasLocaleSettings:
        - LocaleId: ja_JP
          BotAliasLocaleSetting:
            Enabled: true
            CodeHookSpecification:
              LambdaCodeHook:
                LambdaArn: !GetAtt TestLambdaFunction.Arn
                CodeHookInterfaceVersion: '1.0'
      BotAliasName: dev
      BotId: !Ref TestLex
      BotVersion: !GetAtt TestLexVersion1.BotVersion
      ConversationLogSettings:
        TextLogSettings:
          - Enabled: true
            Destination:
              CloudWatch:
                CloudWatchLogGroupArn: !Sub 'arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:${TestLexCloudWatchLogGroup}'
                LogPrefix: dev/
        AudioLogSettings:
          - Enabled: true
            Destination:
              S3Bucket:
                S3BucketArn: !GetAtt TestLexS3Bucket.Arn
                LogPrefix: dev/
  TestLexCloudWatchLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Sub /aws/lex/${ProjectName}-test-lex
      RetentionInDays: 365
  TestLexS3Bucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub ${ProjectName}-test-lex-${AWS::AccountId}

  TestLexRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub ${ProjectName}-test-lex-role
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service: lexv2.amazonaws.com
            Action: sts:AssumeRole
      Policies:
        - PolicyName: !Sub ${ProjectName}-test-lex-policy
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - polly:SynthesizeSpeech
                Resource: '*'
              - Effect: Allow
                Action:
                  - s3:PutObject
                Resource:
                  - !Sub 'arn:aws:s3:::${TestLexS3Bucket}/*'
              - Effect: Allow
                Action:
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource:
                  - !Sub 'arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:${TestLexCloudWatchLogGroup}:*'

  TestLexAssociation:
    Type: AWS::Connect::IntegrationAssociation
    Properties:
      InstanceId: !Ref ConnectInstanceARN
      IntegrationType: LEX_BOT
      IntegrationArn: !GetAtt TestLexAlias.Arn

  # Lambdaのリソースベースポリシー
  # TestLambdaPermission:
  #   Type: AWS::Lambda::Permission
  #   Properties:
  #     Action: lambda:InvokeFunction
  #     FunctionName: !GetAtt TestLambdaFunction.Arn
  #     Principal: lexv2.amazonaws.com
  #     SourceArn: !GetAtt TestLexAlias.Arn
  #     SourceAccount: !Ref AWS::AccountId

  TestLambdaPermission:
    Type: AWS::Lambda::Permission
    Properties:
      Action: lambda:InvokeFunction
      FunctionName: !GetAtt TestLambdaFunction.Arn
      Principal: lexv2.amazonaws.com
      SourceArn: !GetAtt TestLexAlias.Arn
      SourceAccount: !Ref AWS::AccountId

{
  "StringEquals": {
    "AWS:SourceAccount": "123456789012"
  },
  "ArnLike": {
    "AWS:SourceArn": "arn:aws:lex:ap-northeast-1:123456789012:bot-alias/<ボットID>/<エイリアスID>"
  }
}

{
  "StringEquals": {
    "AWS:SourceAccount": "123456789012"
  },
  "ArnLike": {
    "AWS:SourceArn": "arn:aws:connect:ap-northeast-1:123456789012:instance/xxxxxxxxxx"
  }
}

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "connect-ap-northeast-1-xxxxxxxx",
      "Effect": "Allow",
      "Principal": {
        "Service": "connect.amazonaws.com"
      },
      "Action": [
        "lex:RecognizeText",
        "lex:StartConversation"
      ],
      "Resource": "arn:aws:lex:ap-northeast-1:123456789012:bot-alias/<ボットID>/<エイリアスID>",
      "Condition": {
        "StringEquals": {
          "AWS:SourceAccount": "123456789012"
        },
        "ArnEquals": {
          "AWS:SourceArn": "arn:aws:connect:ap-northeast-1:123456789012:instance/xxxxxxxx"
        }
      }
    }
  ]
}