title: appsync to appsync integration - http datasource - AWS IAM
body: <p>I'm trying to follow best practices and I have two business modules A and B - both with AWS <strong>Appsync</strong> and <strong>IAM</strong>.</p>
  <p>Now I need to access module B from module A.</p>
  <p>So I create HTTP Datasource</p>
  <p>(CDK implementation <strong>in A module</strong>)</p>
  <pre class="lang-js prettyprint-override"><code>        const bModuleApiDS = new HttpDataSource(this, 'BModuleApiDS', {
              api: this.api,
              endpoint: bApiEndpoint,
              name: 'BModuleApiDS',
              description: `Data source for : ${bApiEndpoint}`,
              authorizationConfig: {
                  signingRegion: 'eu-west-1',
                  signingServiceName: 'appsync',
              },
              serviceRole: iam.Role.fromRoleArn(this, 'ServiceRoleForApiDS', bApiRoleArn),
          } as unknown as HttpDataSourceProps);
  </code></pre>
  <ol>
  <li>bApiRoleArn - is defined in B module and adds access to specific queries (IAM authorization)</li>
  <li>bApiEndpoint - appsync url for B module</li>
  <li>&quot;as unknown as HttpDataSourceProps&quot; - for some reason HttpDataSourceProps doesn't expose serviceRole (CDK specific), so this is a way how to force it. (maybe because of my cross account issue?)</li>
  </ol>
  <p>All works fine in single account (When module A and module B are in the same account).
  But when A and B are in different accounts, I'm getting the error: <strong>Cross-account pass role is not allowed.</strong></p>
  <p><strong>Question:</strong> How to setup the role / roles / appsync so it's working when module A and module B are in different AWS accounts?</p>
  <hr />
  <p><em><strong>Another try:</strong></em></p>
  <ol>
  <li>Deploy without the role (the default role is created)</li>
  <li>Update the role using CLI:</li>
  </ol>
  <pre class="lang-sh prettyprint-override"><code>aws appsync update-data-source --api-id kcf4l3xkxxxxxxxcsn6cnfoxm  --name BModuleApiDS--type HTTP --service-role-arn arn:aws:iam::9999999999:role/BModuleGraphqlApi-RoleForAModule
  </code></pre>
  <p>I'm getting following error:</p>
  <pre><code>An error occurred (AccessDeniedException) when calling the UpdateDataSource operation: Cross-account pass role is not allowed.
  </code></pre>
  <ul>
  <li>where 999999999999 is B module account</li>
  <li>111111111111 is A module account</li>
  <li>arn:aws:iam::111111111111:user/cli is the deployment user with admin access and iam:passRole permission</li>
  <li>and BModuleGraphqlApi-RoleForAModule is defined as:</li>
  </ul>
  <pre class="lang-json prettyprint-override"><code>{
      &quot;Version&quot;: &quot;2012-10-17&quot;,
      &quot;Statement&quot;: [
          {
              &quot;Action&quot;: &quot;appsync:GraphQL&quot;,
              &quot;Resource&quot;: &quot;arn:aws:appsync:eu-west-1:999999999999:apis/kcf4l3xkxxxxxxxcsn6cnfoxm/types/Query/fields/queryForModuleA&quot;,
              &quot;Effect&quot;: &quot;Allow&quot;
          }
      ]
  }
  </code></pre>
  <p>with trust relationship:</p>
  <pre class="lang-json prettyprint-override"><code>{
    &quot;Version&quot;: &quot;2012-10-17&quot;,
    &quot;Statement&quot;: [
      {
        &quot;Effect&quot;: &quot;Allow&quot;,
        &quot;Principal&quot;: {
          &quot;AWS&quot;: [
            &quot;arn:aws:iam::111111111111:root&quot;,
            &quot;arn:aws:iam::111111111111:user/cli&quot;
          ],
          &quot;Service&quot;: &quot;appsync.amazonaws.com&quot;
        },
        &quot;Action&quot;: &quot;sts:AssumeRole&quot;
      }
    ]
  }
  </code></pre>
  <p><strong>The same question:</strong> How to setup the role / roles / appsync so the module A  can access the module B in different AWS account using IAM authorization (not api key)?</p>
  <p><em>Wider context how appsync can simplify access to multiple microservices (<a href="https://aws.amazon.com/blogs/mobile/appsync-microservices/" rel="nofollow noreferrer">https://aws.amazon.com/blogs/mobile/appsync-microservices/</a>)</em></p>