Dynamodb Cross-account put_item

Question

I have two AWS accounts (account A, and account B). Account A has an EC2 instance, and that instance wants to do a put item to a dynamodb located in account B.

Since it is cross-account access, I created an IAM role on account B to allow account A to do put_item, an IAM role on account A to assume that role and attached the IAM role on the EC2 instance

When I run my program, I get an error message saying that I am trying to use the assume role to put an item to a table that in the same account. (in my code i just sepcified the Account B table name)

It seems that the instance doesn’t realize that the table is on account B even I have the assumerole setup. What am I missing here?

I have also verified that I can put item using AWS CLI (after performing the STS call).

Is there any Java API that I can to specify which dynamodb arn that I want to put the item to?

Error message:

User: arn:aws:sts::ACCOUNT_A:assumed-role/Assume-role/INSTANCE_ID is not authorized to perform: dynamodb:PutItem on resource: arn:aws:dynamodb:us-east-1:ACCOUNT_A:table/TABLE_NAME (Service: AmazonDynamoDBv2; Status Code: 400; Error Code: AccessDeniedException)

Policy on account A:

{ 
"Version": "2012-10-17", 
"Statement": [ { 
"Effect": "Allow", 
"Action": [ "sts:AssumeRole", "sts:GetFederationToken" ], 
"Resource": "arn:aws:iam::AccountA:role/PutItem" }, 

{ "Effect": "Allow", 
"Action": [ "sts:DecodeAuthorizationMessage", "sts:GetAccessKeyInfo", "sts:GetCallerIdentity" ], 
"Resource": "*" } ]
 }

Policy on Account B:

{ 
"Version": "2012-10-17", 
"Statement": [ { 
"Sid": "VisualEditor0", 
"Effect": "Allow", 
"Action": [ "dynamodb:PutItem", "dynamodb:UpdateItem", "dynamodb:UpdateTable" ], 
"Resource": "arn:aws:dynamodb:region:accB:table/table name" },

{ 
"Sid": "VisualEditor1", 
"Effect": "Allow", 
"Action": "dynamodb:*", 
"Resource": "*" } ] 
}

Try to add the permissions to Account A since this account performed the put item action — Amit Baranes, Oct 22 '19 at 07:33
I tried to add dynamodb * permission to account A but it still doesn't work. — A.Ho, Oct 22 '19 at 19:10
As i mentioned before, try to add put item action to Account A policy . take a look at this thread : https://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_cross-account-with-roles.html — Amit Baranes, Oct 22 '19 at 20:31
Looks like there is some problem in my code instead, I just use aws cli and I am able to put item. — A.Ho, Oct 22 '19 at 21:37
Did you figure this out ever? Can you also share the java code where you are instantiating the dynamodb client? — rk2, Mar 28 '20 at 21:35
What is the code using Java SDK to use cross account tablename? — Ansemo Abadía, Aug 04 '21 at 18:02

Dynamodb Cross-account put_item

0 Answers0