Query parameter to specify function version or alias name. The permission will then apply to the specific qualified ARN e.g., arn:aws:lambda:aws-region:acct-id:function:function-name:2
arn:aws:lambda:aws-region:acct-id:function:function-name:2