title: Getting AccessDenied when trying to issue a Lamba function, but why?
body: <p>I've created an AWS Lambda function which is supposed to copy InstanceDBSnapshots from one region to another.</p>
  
  <p>The following policies are attached to the role:</p>
  
  <pre><code>{
      "Version": "2012-10-17",
      "Statement": [
          {
              "Sid": "Stmt1510479591000",
              "Effect": "Allow",
              "Action": [
                  "rds:CreateDBInstance",
                  "rds:CreateDBSecurityGroup",
                  "rds:CreateDBSnapshot",
                  "rds:CreateDBSubnetGroup",
                  "rds:DeleteDBInstance",
                  "rds:DeleteDBSecurityGroup",
                  "rds:DeleteDBSnapshot",
                  "rds:DeleteDBSubnetGroup",
                  "rds:DescribeDBInstances",
                  "rds:DescribeDBSecurityGroups",
                  "rds:DescribeDBSnapshotAttributes",
                  "rds:DescribeDBSnapshots",
                  "rds:DescribeDBSubnetGroups",
                  "rds:ModifyDBInstance",
                  "rds:ModifyDBSubnetGroup",
                  "rds:RestoreDBInstanceFromDBSnapshot"
              ],
              "Resource": [
                  "arn:aws:rds:*"
              ]
          }
      ]
  }
  </code></pre>
  
  <p>And an Amazon policy called: "AWSLambdaBasicExecutionRole".</p>
  
  <p>When I run the function I get the following error:</p>
  
  <blockquote>
    <p>START RequestId: c5f62f26-c7b6-11e7-8fd4-c9b54c37d712 Version: $LATEST
    An error occurred (AccessDenied) when calling the DescribeDBSnapshots
    operation: User:
    arn:aws:sts::ACCOUNT:assumed-role/cc/Cross-Copy-DB-Snapshots is not
    authorized to perform: rds:DescribeDBSnapshots: ClientError</p>
  </blockquote>
  
  <p>I don't understand what is that "arn:aws:sts" and how to allow this function to run properly.</p>
  
  <p>Anyone knows this issue and how to solve it?</p>