assume_role does not return and lambda times out (keywords: aws boto3 sts lambda python3.6)

Question

I am attempting to create a python3.6 AWS lambda function that assumes a role in another account to access an S3 bucket in that another account. I am testing this exact lambda function locally (with aws profile set) to test whether my cross account roles and policies are set up and locally it works flawlessly. However, when running the same code from within lambda it looks like assume_role does not return and the lambda times out. Would appreciate any hint how to approach debugging this or any ideas what could be an issue?

My code:

print ("==== before_assume_role")
assumed_role_object = sts_client.assume_role( 
    RoleArn=FOREIGN_ROLE_TO_ASSUME, RoleSessionName='cross-account-session')
print ("==== after_assume_role")

"==== after_assume_role" does not get printed out, error handler (ie except (Exception) as error ) does not get called and lambda times out.

Any ideas would be extremely appreciated!

Thank you, Constantine

Answer 1

I faced this issue as well, the reason was I was deploying it in a private VPC. My fix was to specify the sts client explicitly.

sts_client = boto3.client('sts',region_name="ap-southeast-1",endpoint_url="https://sts.ap-southeast-1.amazonaws.com")

Change the region name and endpoint url accordingly.