Amazon MQ cross account access

Question

I have Amazon MQ in AWS account A. I want to set this Amazon MQ as a trigger for a lambda function in account B. Lambda does not currently support cross-account triggering for Amazon MQ. How can i do this?

Configure Amazon MQ as trigger for lambda function

Answer 1

When there is no direct support, one needs to build a solution using components that are at their disposal.

Since the end goal is to trigger a lambda function, one option that I can think of is copying the messages from Amazon MQ message broker to AWS SQS as an SQS Queue can be used to trigger a lambda function in another account (assuming that the security policies allow).

For the purpose of copying, there has to be something consuming the MQ broker - another lambda perhaps!

Answer 2

Cross-account triggering for Amazon MQ to Lambda directly is not supported out of the box. However, you can set up a mechanism to achieve this by combining a few AWS services. Here's a step-by-step solution:

1. Amazon MQ in Account A:

   • First, set up the Amazon MQ broker in Account A and make sure it's up and running.

2. AWS Lambda in Account B:

   • Make sure the Lambda function you want to be triggered is set up in Account B.

3. Intermediate Service:

   • Since you cannot directly trigger the Lambda function in Account B from Amazon MQ in Account A, you need an intermediate service. AWS Lambda can be triggered by Amazon SNS or Amazon EventBridge (CloudWatch Events). You can use either of these services as an intermediary.

4. Solution using SNS:

   • Step 1: Create an SNS topic in Account B.
   • Step 2: Allow Account A to publish to this SNS topic by updating the SNS topic policy.
   • Step 3: In Account A, create a Lambda function that listens to the Amazon MQ messages and publishes them to the SNS topic in Account B.
   • Step 4: In Account B, set up the original Lambda function to be triggered by the SNS topic.

5. Solution using EventBridge:

   • Step 1: In Account B, set up an EventBridge event bus.
   • Step 2: Allow Account A to put events to this event bus.
   • Step 3: In Account A, create a Lambda function that listens to the Amazon MQ messages and puts those messages as events onto the event bus in Account B.
   • Step 4: In Account B, set up an EventBridge rule to trigger the original Lambda function whenever a new event (from Account A) is put onto the bus.

This approach allows you to trigger a Lambda function in Account B based on messages in Amazon MQ in Account A, even though it's not a direct integration.