AWS Cross Account movement of data using Lambda

1
votes

I have data that arrives in S3 Account A that i want to automatically copy to S3 Account B but do not understand how i can reference the files in Account A in my Lambda in Account B to do the copy.

Completed Steps so far:

1 Account B Inline policy added to Execution Role referencing Account A S3 bucket

2 Account B Permission given to Account A to invoke Lambda

3 Account A Bucket policy allowing S3 access to role execution Role Account B

4 Account A Event Notification to Account B Lambda (All ObjectCredte events)

Am i missing some steps or is here and if not how can my Lambda directly reference the individual files captured by the event?

1
amazon-web-servicesamazon-s3aws-lambda

1 Answers

0
votes

Update due to comments:

From the question above, I'm not sure I understand the setup, but here's how I would approach this from an architectural perspective:

  1. A Lambda function inside account A gets triggered by the S3 event when an object is uploaded.

  2. The Lambda function retrieves the uploaded object from the source bucket

  3. The Lambda function assumes a role in account B, which grants permission to write into the target bucket.

  4. The Lambda function writes the object into the target bucket.

The permissions you need are:

  • An execution role for the Lambda function in account A that (a) grants permission to read from the source bucket and (b) grants permission to assume the role in account B (see next item below)

  • A cross-account role in account B, (a) trusting the above execution role and (b) granting permission to write into the target bucket

Note: Make sure to save the object granting bucket-owner-full-control so that account B has permissions to use the copied object.

If you want to replicate the objects to a bucket in a different AWS account and don't care about the fact that it can take up to 15 minutes for the replication to be done, you don’t need to build anything yourself. Simply use the Amazon S3 Replication feature.

Replication enables automatic, asynchronous copying of objects across Amazon S3 buckets. Buckets that are configured for object replication can be owned by the same AWS account or by different accounts. You can copy objects between different AWS Regions or within the same Region.