title: AWS Lambda cross-account access denied
body: <p>I have 2 AWS accounts. Account 1 has a CloudSearch domain that I need to query from a Lambda function in account 2. I've followed a <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-user.html" rel="nofollow noreferrer">tutorial here</a> for creating a role in account 1 that allows cross-account access.  </p>
  
  <p>So, in account 1 I have a role <code>arn:aws:iam::111111111111:role/my_cloudsearch_query_role</code> that looks like this:</p>
  
  <pre><code>{
      "Version": "2012-10-17",
      "Statement": [
          {
              "Sid": "VisualEditor0",
              "Effect": "Allow",
              "Action": "cloudsearch:search",
              "Resource": "*"
          }
      ]
  }
  </code></pre>
  
  <p>This role has one trusted entity, account 2, and I can see the correct account ID under the Trusted Entities section for the role in the IAM console.</p>
  
  <p>In account 2, I've created a Lambda function with an execution role that looks like this:</p>
  
  <pre><code>{
    "roleName": "my_cloudsearch_query_role",
    "policies": [
      {
        "document": {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Action": [
                "logs:CreateLogGroup",
                "logs:CreateLogStream",
                "logs:PutLogEvents"
              ],
              "Resource": "arn:aws:logs:*:*:*"
            },
            {
              "Effect": "Allow",
              "Action": "sts:AssumeRole",
              "Resource": "arn:aws:iam::111111111111:role/my_cloudsearch_query_role"
            }
          ]
        },
        "name": "oneClick_lambda_basic_execution_1526469274620",
        "type": "inline"
      }
    ]
  }
  </code></pre>
  
  <p>My Lambda function (Python 3) code tries to query CloudSearch like this:</p>
  
  <pre><code>client = boto3.client('cloudsearchdomain', endpoint_url=endpoint)
  response = client.search(
      query="(and name:'foobar')",
      queryParser='structured',
      returnFields='curr_addr',
      size=1
  )
  </code></pre>
  
  <p>All calls to the Lambda function fail with the following error:</p>
  
  <blockquote>
    <p>An error occurred (AccessDenied) when calling the Search operation: User: arn:aws:sts::222222222222:assumed-role/my_cloudsearch_query_role/my_lambda_func is not authorized to perform: cloudsearch:search on resource: myCSDomain</p>
  </blockquote>
  
  <p>I'm positive that I've gotten the account IDs correct so there's no mix-up. Is there something else I need to do to get it working?</p>