AWS 账户 A lambda 试图触发 B 账户的 ecs 运行任务

Question

code in lambda function -

String arn = "arn:aws:ecs:eu-west-1:accountId(B-account):task-definition/task-defn-name";
        
String cluster="arn:aws:ecs:eu-west-1:accountId(B-account):cluster/cluster name"; 
       
RunTaskRequest request = new RunTaskRequest().withLaunchType(LaunchType.EC2).withCluster(cluster).withTaskDefinition(arn);
        
 final STSAssumeRoleSessionCredentialsProvider cross_acct_lambda = new STSAssumeRoleSessionCredentialsProvider.Builder("AccountB-Role", "cross_acct_lambda").build();
        RunTaskResult response = AmazonECSClientBuilder.standard().withCredentials(cross_acct_lambda).build().runTask(request);

This worked i was using default credential provider instead STSAssumeRoleSessionCredentialsProvider

Permission policy in Account B role

{
            "Effect": "Allow",
            "Action": [
                "ecs:RunTask",
                "ecs:Describe*",
                "ecs:List*"
            ],
            "Resource": [
                "*"
            ]
        }

Trust relationship of Role in B account

"Statement": [
    {
      "Sid": "",
      "Effect": "Allow",
      "Principal": {
        "Service": [
          "ecs-tasks.amazonaws.com",
          "ec2.amazonaws.com"
        ]
      },
      "Action": "sts:AssumeRole"
    },
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::AccountId-Aaccount:role/ecsLambdaRole"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

A- Account role

{
    "Version": "2012-10-17",
    "Statement": {
        "Effect": "Allow",
        "Action": "sts:AssumeRole",
        "Resource": "arn:aws:iam::AccountId-Baccount:role/role name"
    }
}
 

Answer 1

Sadly, you can't do this directly as you are attempting.

Usually, cross-account operations are enabled through cross-account roles .

For this to work in your use-case you would have to do the following:

1. Setup an assumable role in AccB . The role would have a policy with permissions to start its ecs task. The trust relationship would allow AccA to assume the role.

2. A lambda execution role in AccA would have permissions to assume the role from AccB (ie sts:AssumeRole ).

3. The lambda would use STS service to explicitly assume the role . The call to STS would return temporary IAM credentials. The credentials would allow you to create a session in your lambda function to trigger ECS tasks in AccB.

How to assume the role in lambda from AccB is explained in the following AWS blog post :

• How can I configure a Lambda function to assume a role from another AWS account?