Cross Region & Cross Account SNS Notification to Lambda

Hello,

The error indicates an invalid security token.

• The Lambda function's execution role in Account B allows sns.amazonaws.com to invoke it.
• The SNS topic policy in Account A allows it to publish to the Lambda function in Account B.

Verify Permissions in Account B (Lambda): Ensure that the Lambda function's execution role in Account B has the necessary permissions to allow SNS from Account A to invoke it.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "sns.amazonaws.com"
      },
      "Action": "lambda:InvokeFunction",
      "Resource": "arn:aws:lambda:ap-southeast-3:ACCOUNT_B_ID:function:YourLambdaFunctionName",
      "Condition": {
        "ArnLike": {
          "AWS:SourceArn": "arn:aws:sns:ap-southeast-1:ACCOUNT_A_ID:YourSNSTopicName"
        }
      }
    }
  ]
}

Verify SNS Topic Policy in Account A

Ensure the SNS topic policy allows the SNS service to publish to the Lambda function in Account B.

{
  "Version": "2012-10-17",
  "Id": "Policy_ID",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::ACCOUNT_B_ID:role/LambdaExecutionRole"
      },
      "Action": "SNS:Publish",
      "Resource": "arn:aws:sns:ap-southeast-1:ACCOUNT_A_ID:YourSNSTopicName"
    }
  ]
}

Referral Link: https: https://repost.aws/knowledge-center/sns-with-crossaccount-lambda-subscription