Cross-account DynamoDB to Redshift Serverless Zero-ETL integration fails with “You don’t have access” error

Question

I'm trying to set up a Zero-ETL integration from a DynamoDB table in Account A to a Redshift Serverless workgroup in Account B, but I’m consistently hitting this error when attempting to create the integration from the Redshift (destination) account:

InvalidParameterValue: You don't have access to zero-ETL integrations because the source DynamoDB table doesn't exist or you don't have the required permissions. Check the resource and key policy on the source table and make sure you have the required permissions. Refer to the Amazon DynamoDB Developer Guide for instructions on how to update the policy if required and then continue creating the integration.

Configuration
* Source Account ID (DynamoDB): 111111111111
* Destination Account ID (Redshift): 222222222222
* DynamoDB Table Name: example-table
* Region: us-east-1
* Redshift IAM Role: arn:aws:iam::222222222222:role/RedshiftIntegrationRole
* Workgroup Name: example-workgroup
* KMS Key: Customer-managed key in source account

What I’ve Done So Far

* Added a resource-based policy to the DynamoDB table with:
Actions: dynamodb:ExportTableToPointInTime, dynamodb:DescribeTable, dynamodb:DescribeExport
* Principal set to the Redshift IAM role ARN
* Verified that the IAM role is attached to the Redshift Serverless workgroup
* IAM role has an inline policy that allows the above actions on the DynamoDB table ARN and export resources
* The DynamoDB table is encrypted using a customer-managed KMS key
* The KMS key policy includes permissions for the Redshift IAM role:
 kms:Decrypt, kms:DescribeKey

Questions
Are there any Redshift-specific resource policies or role trust configurations that might cause this issue?
Any insights into why the integration still fails even though the policies appear correct?

I’d really appreciate any guidance, examples, or troubleshooting tips from anyone who has gotten this working cross-account.

Thanks in advance!

smovila · Accepted Answer

Have in cloudtrail the following error:

"userAgent": "AWS Internal",
    "errorCode": "InvalidParameterValueException",
    "errorMessage": "An unknown error occurred",
    "requestParameters": {
        "sourceArn": "arn:aws:dynamodb:us-east-1:1111111:table/table",
        "targetArn": "arn:aws:redshift-serverless:us-east-1:22222:namespace/id",
        "integrationName": "IntegrationName",
        "kMSKeyId": "kmsKeyID,
        "tagList": []
    },

Cross-account DynamoDB to Redshift Serverless Zero-ETL integration fails with “You don’t have access” error

Add your answer

Relevant content