title: Cross-account, cross-region SQS / SNS subscription using Java AWS SDK
body: <p>I have the following setup on AWS:</p>
  
  <p><strong>Account A</strong> owns an SNS topic in us-west-2. Permissions for subscription are allowed for anyone. I do not have access to an IAM role in this account.</p>
  
  <p><strong>Account B</strong> owns an SQS queue in eu-west-1. I have full access to this account.</p>
  
  <p>I want to subscribe the SQS queue on account B to the topic on account A. I have tried the following with the AWS Java SDK, version 1.11:</p>
  
  <pre><code>    AmazonSNSClient snsClient = new AmazonSNSClient(&lt;credentials from B&gt;);
      snsClient.setEndpoint(&lt;sns endpoint with region&gt;);
      snsClient.setRegion(Region.getRegion(Regions.fromName(region)));
  
      SubscribeRequest subscribeRequest = new SubscribeRequest()
              .withEndpoint(sqsQueueArn)
              .withProtocol("sqs")
              .withTopicArn(snsTopicArn);
  
      snsClient.subscribe(subscribeRequest);
  </code></pre>
  
  <p>But I keep getting an <code>InvalidParameterException</code>:</p>
  
  <pre><code>com.amazonaws.services.sns.model.InvalidParameterException: Invalid parameter: TopicArn (Service: AmazonSNS; Status Code: 400; Error Code: InvalidParameter; Request ID: 00e878c5-8766-5fe1-8670-281bd3ca8d87)
      at com.amazonaws.http.AmazonHttpClient$RequestExecutor.handleErrorResponse(AmazonHttpClient.java:1586)
      at com.amazonaws.http.AmazonHttpClient$RequestExecutor.executeOneRequest(AmazonHttpClient.java:1254)
      at com.amazonaws.http.AmazonHttpClient$RequestExecutor.executeHelper(AmazonHttpClient.java:1035)
      at com.amazonaws.http.AmazonHttpClient$RequestExecutor.doExecute(AmazonHttpClient.java:747)
      at com.amazonaws.http.AmazonHttpClient$RequestExecutor.executeWithTimer(AmazonHttpClient.java:721)
      at com.amazonaws.http.AmazonHttpClient$RequestExecutor.execute(AmazonHttpClient.java:704)
      at com.amazonaws.http.AmazonHttpClient$RequestExecutor.access$500(AmazonHttpClient.java:672)
      at com.amazonaws.http.AmazonHttpClient$RequestExecutionBuilderImpl.execute(AmazonHttpClient.java:654)
      at com.amazonaws.http.AmazonHttpClient.execute(AmazonHttpClient.java:518)
      at com.amazonaws.services.sns.AmazonSNSClient.doInvoke(AmazonSNSClient.java:2003)
      at com.amazonaws.services.sns.AmazonSNSClient.invoke(AmazonSNSClient.java:1979)
      at com.amazonaws.services.sns.AmazonSNSClient.subscribe(AmazonSNSClient.java:1881)
  </code></pre>
  
  <p>My theory of why this is happenning is that since the <code>snsClient</code> belongs to account B it is unable to find the SNS topic within the account, so it fails.</p>
  
  <p>The question is, can I subscribe the SQS queue on B to the topic on A using the latest Java SDK for AWS?</p>
  
  <p>Some more thoughts:</p>
  
  <ul>
  <li>It seems doable for Lambda functions: <a href="http://docs.aws.amazon.com/lambda/latest/dg/with-sns-create-x-account-permissions.html" rel="nofollow noreferrer">http://docs.aws.amazon.com/lambda/latest/dg/with-sns-create-x-account-permissions.html</a> , but for some reason it's not working in my case.</li>
  <li>I am able to do this subscription from Account B's UI, but not programmatically. So it might be a gap in the SDK itself.</li>
  </ul>