How to use the @aws-cdk/aws-lambda.CfnPermission function in @aws-cdk/aws-lambda

vpcSecurityGroupIds: securityGroup.securityGroupId,
        vpcSubnetIds: subnetIds.join(',')
      }
    });

    // Dummy import to reference this function in the rotation schedule
    const rotationLambda = lambda.Function.fromFunctionArn(this, 'RotationLambda', Stack.of(this).formatArn({
      service: 'lambda',
      resource: 'function',
      sep: ':',
      resourceName: rotationFunctionName
    }));

    // Cannot use rotationLambda.addPermission because it's a no-op on imported
    // functions.
    const permission = new lambda.CfnPermission(this, 'Permission', {
      action: 'lambda:InvokeFunction',
      functionName: rotationFunctionName,
      principal: `secretsmanager.${Stack.of(this).urlSuffix}`
    });
    permission.node.addDependency(application); // Add permission after application is deployed

    const rotationSchedule = props.secret.addRotationSchedule('RotationSchedule', {
      rotationLambda,
      automaticallyAfter: props.automaticallyAfter
    });
    rotationSchedule.node.addDependency(permission); // Cannot rotate without permission
  }
}