Amazon S3 triggering another a Lambda function in another account

user_8196177 0
Viewed 26835

I want to run a lambda in Account B when any object comes into Account A S3 bucket.

But I heard that we can access Lambda from the same account S3 only, for cross-account S3 Lambda access I must run Lambda within same account and make another trigger which runs another account Lambda:

  1. S3(Account A)--> Lambda(Account B)- not possible
  2. S3(Account A)--> Lambda(Account A)-->Lambda(Account B)- Possible

Can someone help me which option is possible? If so how?

aws-lambda amazon-web-services amazon-s3
5 Answers

Here is how you do this in clear steps:

I defined (Customer Account) as the account that contains the S3 resource, "Service Account" as the account that contains the Lambda function, that will access the S3 resource.

  1. Create assumed role on Customer Account with full S3 access,
  2. Create trust policy in assumed role pointing at Lambda ARN

  3. Attach IAM policy to Lambda execution role on Service Account - pointing at Customer account / assumed role (Reference: https://aws.amazon.com/premiumsupport/knowledge-center/lambda-function-assume-iam-role/)

  4. Create object notification event on target S3 bucket on customer account, to notify Lambda ARN on service account. (Reference: https://docs.aws.amazon.com/AWSJavaScriptSDK/latest/AWS/S3.html#putBucketNotificationConfiguration-property)

user_106825370
Related