Cross-account Lambda Invocation

Question

I have a main management account and I want to access information in a another account through a Lambda function. Let an imaginary use case be pushing an object into an S3 bucket in the main account which contains S3 bucket information of all the sub-accounts. 
How would I achieve this if the whole system is managed by AWS Organizations?

Riku_Kobayashi · Accepted Answer

Hello.

I think the following documentation will be helpful.  
To access S3 in another account from Lambda in the main account, you need to set the S3 bucket policy to allow Lambda's IAM role.  
https://repost.aws/knowledge-center/access-denied-lambda-s3-bucket

Alternatively, you can access the S3 bucket by configuring the Lambda IAM role to assume the IAM role of the AWS account that owns the S3 bucket, as described in the following document.  
https://repost.aws/knowledge-center/lambda-function-assume-iam-role

Cross-account Lambda Invocation

Add your answer

Relevant content