AWS ElasticSearch write to account “A” from lambda in account “B”


I have an AWS ElasticSearch Cluster in account “A”.

I’m trying to create a lambda (triggered from a DynamoDB Stream) in account “B” that will write to ES in account “A”.

I’m getting the following error:

I have tried putting the STS as well as the ROLE into the ES access policy (within account “A”) with no luck. Here is my policy:


In my code above I was adding arn:aws:sts::AccountB:assumed-role/lambdaRole1/sourceTableToSNS into the AccountA ES access list, that is wrong. Instead do the following:

I already had arn:aws:iam::AccountA:role/beta-na-DynamoDBStreamLambdaElasticSearch in the ES access list, I needed to add a trust relationship (from the IAM role screen) for that role to be assumable by AccountB. I added this into the trust relationship:

Then, in my accountB lambda code, I needed to assume that role. Here is the relevent code from the lambda.

Leave a Reply