How do I invoke my Lambda function using a cross-account Kinesis stream?

Last updated: 2020-09-25

Lambda doesn't currently support cross-account triggers from Kinesis or any stream-based sources.

As a workaround, you can use a "poller" Lambda function in the same account as the Kinesis stream (account A) to invoke a "processor" Lambda function in the other account (account B).

Warning: This configuration removes many of the benefits of using Kinesis Data Streams, such as sequential ordering and blocking of records within a shard. We recommend using this workaround only if your application doesn't need those features.

1. Create a Lambda function in account A with an execution role.
   Note: You can create the function using the Lambda console, or by building and uploading your own deployment package.
2. Give the execution role in account A permissions related to the Kinesis stream.
3. Configure the Kinesis stream as the event source.
   Important: When you create the event source mapping, make sure that the Lambda function and the Kinesis stream are in the same account.

1. Create a Lambda function in account B with an execution role.
2. Create an AWS Identity and Access Management (IAM) role in account B. This "invocation role" is assumed by the function in account A to invoke the function in account B.
3. Modify the policy of the invocation role as follows:
   Give it permissions to invoke (using the lambda:InvokeFunction action) the Lambda function in the same account (account B).
   Edit the trust relationship to allow the execution role in account A to assume the invocation role.

For more information, see Identity-based IAM policies for AWS Lambda and Creating a role to delegate permissions to an AWS service.

1. Modify the policy of the execution role in account A. Give it permissions to call the AssumeRole API (using the sts:AssumeRole action) to assume the execution role in account B. For more information, see Granting a user permissions to switch roles.
2. Update your Lambda function in account A so that it assumes the invocation role in account B. For more information and an example, see Switching to an IAM role (AWS API). In addition, account A passes the input event from function A to the function in account B by instantiating a service client and using the appropriate SDK method to request asynchronous invocation (invocation type Event).
   Note: To determine the SDK method to call, see the SDK documentation for your runtime.
3. Configure a dead-letter queue (DLQ) for the function in account B. This allows you to investigate or retry any missed events in case of a function error.