- Newest
- Most votes
- Most comments
You're correct - event source mappings in AWS Lambda do not support cross-account processing. The error message you're receiving ("Role and event source must be in the same account as the cloud function") confirms this limitation.
While you might be able to technically access Kafka topics in a different account using broker endpoints, Lambda's event source mapping functionality specifically requires that the event source, the execution role, and the Lambda function all reside in the same AWS account.
This is a known limitation with Lambda event source mappings. For example, with Amazon MQ event sources, Lambda explicitly does not support cross-account processing - you cannot use Lambda to process records from a message broker that is in a different AWS account.
For cross-account event processing, you would need to consider alternative architectures. One common approach for cross-account event handling is to use Amazon EventBridge, which does support cross-account event delivery. With EventBridge, you can set up an event bus in one account and configure it to send events to targets (including Lambda functions) in another account. This requires proper IAM permissions and resource policies to enable the cross-account access.
Sources
Using Lambda with Amazon MQ - AWS Lambda
Create a cross-account Amazon EventBridge connection in an organization - AWS Prescriptive Guidance
Sending events to an AWS service in another account in EventBridge - Amazon EventBridge
answered 10 months ago
Please note, you can't create cross-account event source mappings for serverless MSK clusters.
answered 10 months ago
