By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post

Can Pinpoint campaign / journey custom channel call a lambda in another AWS account?

0

Can a Pinpoint campaign / journey custom channel call a lambda function in another AWS account?

I have tried adding the following permission to my lambda but it did not work:

aws lambda add-permission --function-name helloWorld --statement-id sid0 --action lambda:InvokeFunction --principal pinpoint.ap-south-1.amazonaws.com --source-arn arn:aws:mobiletargeting:ap-south-1:ACCOUNT_ID:apps/* --source-account ACCOUNT_ID

Can someone share any info on whether lambda functions can be called from services like S3, Pinpoint, etc. in other aws accounts? (I am aware of lambdas being allowed by external IAM users, but in my case the Pinpoint service makes the call to lambda and needs the required permissions)

Topics
ServerlessComputeSecurity, Identity, & ComplianceFront-End Web & MobileBusiness Applications
Tags
AWS LambdaAWS Identity and Access ManagementAmazon Pinpoint
Language
English
renzil
asked 8 months ago230 views
1 Answer
0

Hi,

You should follow this service-neutral guidance and full example to achieve cross-account calls with Lambdas: https://gist.github.com/helephant/57d10c022f22e8209118b459a5afb60d

Best,

Didier

profile pictureAWS
EXPERT
Didier_Durand
answered 8 months ago
  • renzil
    8 months ago

    Thank you Didier.

    This solution involves invoking 2 lambdas, one acting like a proxy to bridge the permission issue.

    Is there no way to use just 1 lambda in account A that can be called from a service like Pinpoint in account B? Pinpoint internally calls a lambda during a campaign / journey. This is specified through the Pinpoint API as an ARN string. I have tried giving the ARN of the lambda in account A, along with relaxing the permissions for this lambda to allow incoming requests from Pinpoint in account B, but this does not seem to work.

    Can you positively confirm that Pinpoint campaign / journey lambda invocations cannot be done cross-account through a single lambda invocation?

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions

Relevant content