2

I'm trying to access a dynamodb table in another account without having to make any code changes if possible. I've setup the IAM users, roles and policies to make this possible and have succeeded with other services such as sqs and s3.

The problem I have now is with dynamodb as the code to intialise the boto3.resource connection seems to only allow me to point to the name. docs

dynamodb = boto3.resource('dynamodb', region_name='us-east-2')

table = dynamodb.Table(config['dynamo_table_1'])

This causes the problem of the code trying to access a table with that particular name in the account the code is executing in which errors out as the table exists in a different AWS account.

Is there a way to pass the ARN of the table or some identifier that would allow me to specify the accountID?

Damian Jacobs
  • 488
  • 6
  • 21
  • 1
    I don't think you can do that. I could be wrong. I suspect what you need to do is `sts.assume_role` then create the `Resource` with those credentials Then, create the `Table` sub-resource on that. – theherk Feb 07 '22 at 14:23
  • Thank you, based on what I could find before that was the same conclusion I reached but I was hoping that I was wrong. – Damian Jacobs Feb 07 '22 at 14:26

1 Answers1

1

There's sample code at https://docs.aws.amazon.com/prescriptive-guidance/latest/patterns/configure-cross-account-access-to-amazon-dynamodb.html which shows how to do cross-account access. Here is a snippet from the the attached zip. I expect you could do .resource() as well as .client() with the same arguments.

import boto3
from datetime import datetime


sts_client = boto3.client('sts')
sts_session = sts_client.assume_role(RoleArn='arn:aws:iam::<Account-A ID>::role/DynamoDB-FullAccess-For-Account-B',
                                      RoleSessionName='test-dynamodb-session')


KEY_ID = sts_session['Credentials']['AccessKeyId']
ACCESS_KEY = sts_session['Credentials']['SecretAccessKey']
TOKEN = sts_session['Credentials']['SessionToken']


dynamodb_client = boto3.client('dynamodb',
                                region_name='us-east-2',
                                aws_access_key_id=KEY_ID,
                                aws_secret_access_key=ACCESS_KEY,
                                aws_session_token=TOKEN)
hunterhacker
  • 6,378
  • 1
  • 14
  • 11
  • 1
    Thank you @hunterhacker, I was wanting to avoid this approach because it means I need to make a code change and I was trying to get away with configuration and iam policy changes only – Damian Jacobs Feb 08 '22 at 06:36