How do I invoke a Lambda function through a cross-account Kinesis stream?

Resolution

Amazon Kinesis Data Streams supports resource-based policies. This allows you to process data ingested into a stream in one account with an AWS Lambda function in another account.

Follow the steps below to create the Lambda function and then configure it to access your Kinesis Data Stream.

Create a Lambda execution role

1. Access the IAM console and choose the Roles tab.
2. Choose Create Role.
3. For AWS Service, choose Trusted Entity Type. For Service, choose Lambda.
4. In the Permissions policies table, select the managed IAM policy AWSLambdaKinesisExecutionRole.
5. Provide a name for the role and choose Create Role.

Note: The managed IAM policy AWSLambdaKinesisExecutionRole has the required Kinesis Data Streams and Lambda invocation permissions. It also grants access to all potential Kinesis Data Streams resources that you might be able to access.

Create the Lambda function

Create an AWS Lambda function that can process records in an Amazon Kinesis data stream.

For Execution role, choose the role that you created.

Note: This policy has the required Kinesis Data Streams and Lambda invocation permissions. It also grants access to all potential Kinesis Data Streams resources that you may be able to access.
Add the execution role to the Kinesis Data Streams resource owner to configure the resource policy.

Configure the Kinesis Data Stream

1. Access the Amazon Kinesis Data Streams console, and choose your data stream.
2. Choose the Data stream sharing tab.
3. Choose the Create policy button to start the visual policy editor.
4. Choose the consumer in the Enhanced fan-out tab to share a registered consumer within a data stream.
5. Choose Create policy. You can also write the JSON policy directly.
6. For Principal, enter the cross-account Lambda execution role that you created. Be sure to include the action kinesis:DescribeStream.
   For more information on example resource policies for Kinesis Data Streams, see Example resource-based policies for Kinesis Data Streams.
7. Choose Create policy. Or, use the PutResourcePolicy to attach the policy to your resource.

If you use server-side encryption with an AWS managed key, and want to share access through a resource policy, then you must use a customer managed key (AWS KMS key). For more information, see What is server-side Encryption for Kinesis Data Streams? Also, you must allow your sharing principal entities to have access to your KMS key through KMS cross-account access. For more information, see Allowing users in other accounts to use a KMS key.