Can't add s3 notification for lambda using boto3

One has to add permissions on the lambda end to allow S3 to invoke the lambda function. Beware, if you manually create the event source mapping using the AWS Lambda GUI and then delete the event source mapping, the permission still exists! So you won't get the above error.

However, if you start from scratch and then try to add the notification, the above error will occur.

Permissions are added by:

 client = ...boto3 lambda client
 response = client.add_permission(
     FunctionName=lambda_name,
     StatementId='1',
     Action='lambda:InvokeFunction',
     Principal='s3.amazonaws.com',
     SourceArn=s3_arn,
     SourceAccount='66666666666'
 )