Cross-Account Step Functions Callback Issue

To ensure seamless interaction between accounts A and B, follow these steps:

1. Create Role in Account B: Establish a role within account B that permits account A to assume it as a trusted entity. Additionally, grant this role permissions to execute actions on the lambda function within account B.
2. Create Role in Account A: Set up a role within account A, allowing it to assume the role defined in account B as a trusted entity.

This configuration establishes the following relationship:

Role A ==> Role B ==> Perform action over lambda in B

The "Access Denied" exception arises when the role in Account B lacks the requisite permissions to execute actions on the lambda function.

Here are examples of roles in both accounts with their trusted entities:

Policy in Account A:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::987654321098:role/LambdaExecutionRole"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

Policy in Account B:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::123456789012:role/CrossAccountRole"
      },
      "Action": "sts:AssumeRole"
    },
    {
      "Effect": "Allow",
      "Action": [
        "lambda:InvokeFunction",
        "states:SendTaskSuccess"
      ],
      "Resource": [
        "arn:aws:lambda:region:123456789012:function:my-function",
        "arn:aws:states:region:account-id:stateMachine:state-machine-name"
      ]
    }
  ]
}

Hi, In order the Lambda function to invoke actions in Account A, it needs to assume a role in Account A that gives it permissions to call Step Functions actions in account A. The IAM role in Account A needs to have the required permissions and a trust relationship policy that allows the IAM role in account B to assume it. Lambda function in Account B must include code to use STS tu assume the role in account A and get temporary credentials that allows it to use resources defined in Account A (step functions). Once get temporary credentials, use those credentials to send the task success for the step function in Account A. Please check the following re:Post as reference https://repost.aws/knowledge-center/lambda-function-assume-iam-role

Hello,

Verify the IAM execution role used by the Lambda function has the correct permissions to call sendTaskSuccess on the Step Function in account A. It will need sfn: SendTaskSuccess permissions Also check below link ---- https://docs.aws.amazon.com/step-functions/latest/dg/troubleshooting-service-integrations.html

Hi,

I'd strongly suggest to read the following 2 blog posts to get your implementation working as they provide answers to your questions:

• https://aws.amazon.com/blogs/compute/running-cross-account-workflows-with-aws-step-functions-and-amazon-api-gateway/
• https://aws.amazon.com/blogs/compute/introducing-cross-account-access-capabilities-for-aws-step-functions/

Best,

Didier