Cross-account lambda trigger by kinesis

Question

I'm trying to trigger a lambda in account 'B' by a Kinesis stream in account 'A'. This is similar to what's described here, except the example uses S3 instead of Kinesis.

To do this, I'm trying to set up the right permissions, but running into difficulties.

First I add this permission:

  aws lambda add-permission \
--function-name "$function_name" \
--statement-id 'Id-123' \
--action "lambda:InvokeFunction" \
--principal $source_account \
--source-arn "$stream_arn" \
--source-account $source_account \
--region us-east-1 \
--profile "$profile"

Where $source_account is the account ID for 'A'.

Then I attempt to create the source mapping:

 aws lambda create-event-source-mapping \
    --event-source-arn "$stream_arn" \
    --function-name "$function_name" \
    --starting-position TRIM_HORIZON \
    --region us-east-1 \
    --profile "$profile"

And I get the following error:

A client error (InvalidParameterValueException) occurred when calling the CreateEventSourceMapping operation: Role and event source must be in the same account as the cloud function

I don't understand this error. Is it saying what I'm trying to do is impossible? But then how was it accomplished here with S3, which is essentially the same mechanism?

Have you note that theres a point that: Note that the principal becomes the S3 service (it gets a service name as opposed to an account number) and the actual account number moves to the “source-account” parameter. But you still use $source_account as principal try to change it to Kinesis service. I think it will work. — Larry Bekchyan, Jan 29 '19 at 15:05

score 3 · Answer 1 · answered Jan 23 '19 at 05:21

3

AWS Lambda function to an Amazon Kinesis stream only works when both in the same account.

If you want to call functions in account B, you can hook the fan out function deployed in account A to your stream in account A, and ask it to call with a cross-account role a function in account B. create a target of type Lambda and specify a role in account B.

answered Jan 23 '19 at 05:21

vaquar khan

10,864
5
72
96

I found this [aws documentation](https://aws.amazon.com/premiumsupport/knowledge-center/lambda-cross-account-kinesis-stream/) useful confirmation of the answer above. – lukenetsurfer Jan 06 '23 at 15:46

score 1 · Answer 2 · answered Sep 04 '18 at 23:07

1

Creating cross-account event source mappings between AWS Kinesis and Lambda is not supported. Kinesis event source mappings use polling as opposed to the push model of S3.

answered Sep 04 '18 at 23:07

Sean Bollin

870
2
10
17

Cross-account lambda trigger by kinesis

2 Answers2

Linked