运行 AWS Lambda function 以跨账户核对证书

Question

I am using this lambda function to notify expiring acmes certs. It is working fine for the account in which I am executing it, let suppose Account A.

I want to this function to work cross account and

• loop over all my AWS account, detect expiring certs
• Do a SNS publish for certs of other account.

Can someone guide me: How do I make this lambda function in account "A" look for certs in all my AWS account and do a SNS publish?

Answer 1

You would need to create a role in each of the other accounts which have the permissions to view ACM and grant access the account the Lambda is being run in.

Then update the Lambda role to allow it to assume the roles from other accounts.

You would need to have a list of accounts to know which one to assume the role of.

Additional Links

• https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html
• https://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_cross-account-with-roles.html