CDKでAPI Gatewayにステージを追加してもLambdaのパーミッションは自動で追加されない

import * as cdk from '@aws-cdk/core'
import * as lambda from '@aws-cdk/aws-lambda'
import * as apigateway from '@aws-cdk/aws-apigateway'
import * as iam from '@aws-cdk/aws-iam'

export class CdkLambdaStack extends cdk.Stack {
  constructor(scope: cdk.Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props)
    // Lambdaの定義
    const lambdaFn = new lambda.Function(this, 'function', {
      runtime: lambda.Runtime.PYTHON_3_8,
      handler: 'lambda_function.lambda_handler',
      code: lambda.Code.asset('lambda_asset')
    })

    // API Gatewayの定義
    const api = new apigateway.RestApi(this, 'api', {
      deployOptions: {
        stageName: 'first stage name',
        variables: {foo: 'bar'}
      }
    })

    // ステージの追加
    const stage = new apigateway.Stage(this, 'stage', {
      deployment: new apigateway.Deployment(this, 'stage', {api: api}),
      stageName: 'second stage',
      variables: {foo: 'bar_bar'}
    })
    api.root.addResource(lambdaFn.functionName).addMethod('POST', new apigateway.LambdaIntegration(lambdaFn))

    // 追加したステージからのPermissionをlambdaに追加が必要
    new lambda.CfnPermission(this, 'secondStageInvoke', {
      action: 'lambda:InvokeFunction',
      functionName: lambdaFn.functionName,
      principal: 'apigateway.amazonaws.com',
      sourceArn: 'arn:aws:execute-api:' + this.region + ':' + this.account + ':' + api.restApiId + '/' + stage.stageName + '/POST/' + lambdaFn.functionName
    })
  }
}