I want my lambda code to directly upload files into an Amazon S3 bucket of a different account

user_14879635 0
Viewed 321

So I have a lambda function that triggers an Amazon SageMaker processing job and this job currently writes a few files to my Amazon S3 bucket. I have mentioned my output_uri ='s3://outputbucket-in-my-acc/' Now I want the same files to be directly uploaded to a different AWS account and not in my account. How do i achieve this? I want no traces of the file to be stored in my account.

I found a similar solution here but this copies the file into the different account while the original files are still present in the source account: AWS Lambda put data to cross account s3 bucket

amazon-iam aws-lambda amazon-sagemaker amazon-web-services amazon-s3
2 Answers

Your Lambda Function (Account A) needs to assume a role in the other account (Account B) which has the permissions to write to the s3 location. For that you need to establish trust between the accounts with a cross account role.

Afterwards you assume the role in Account B from your Lambda function's code and execute the S3 command.

Find an example with boto3 here: https://aws.amazon.com/premiumsupport/knowledge-center/lambda-function-assume-iam-role/

user_4679440

The SageMaker APIs for job creation typically (always?) include a RoleARN which will be the IAM role that SageMaker assumes to do work on your behalf. That IAM role must have the necessary permissions so that Amazon SageMaker can successfully complete its task (e.g. have PutObject permission to the relevant S3 bucket) and must have the necessary trust policy allowing the SageMaker service (sagemaker.amazonaws.com) to assume the role.

user_2714150
Related