在其他AWS账户中查询Dynamodb-无服务器框架

Question

I need to connect to the dynamoDB table in one AWS account from lambda of a different AWS account. Currently, I'm trying to connect to dynamodb through Serverless Offline. I'm able to connect to a table in my AWS account but get an error when trying to connect to dynamoDB table in another account.

Error: Request Not Found. (I have checked twice. The table does exist.)

The role I'm using in the serverlesss.yml has full admin privileges(including DynamoDB)

serverless.yml

provider:
  name: aws
  runtime: nodejs6.10
  role: "arn:aws:iam::******:role/abcRole"
  iamRoleStatements:
    - Effect: Allow
      Action: ["dynamodb:*"]
      Resource: "arn:aws:dynamodb:us-east-1:*:*"



db.js

let dynamodbOnlineOptions = {
    region: 'us-east-1'
};

let client = new AWS.DynamoDB.DocumentClient(dynamodbOnlineOptions);

I think I'm making some mistake with permissions, but I'm able to identify the problem. Please help.

Answer 1

The way forward I think is to create a cross account role that has access to that table, then have your lambda function assume that role.

Create the cross account role in the account that has the Dynamodb table and give it access to that.

http://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_cross-account-with-roles.html

Inside your lambda function have it assume that role and get temporary credentials to access that table.

http://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html