I have an AWS lambda that needs to access s3 resource in another AWS account. The lambda execution role has the following policies attached to it:
eg: cross account role is cross-account-role-staging
{
"Version": "2012-10-17",
"Statement": [
{
"Action": [
"logs:PutLogEvents",
"logs:CreateLogStream"
],
"Effect": "Allow",
"Resource": "arn:aws:logs:us-east-1:<AWSAccountId>:log-group:/aws/lambda/*",
"Sid": ""
}
]
}
{
"Version": "2012-10-17",
"Statement": [
{
"Action": "sts:AssumeRole",
"Effect": "Allow",
"Resource": "arn:aws:iam::<CrossAWSAccountId>:role/cross-account-role-staging",
"Sid": ""
}
]
}
I use the following function to get cross account credentials using STS:
export async function getCrossAccountCredentials(roleArn: string): Promise<Credentials> {
const sts = new STS()
return new Promise((resolve, reject) => {
const params = {
RoleArn: roleArn,
RoleSessionName: roleSessionName
}
sts.assumeRole(params, (err, data) => {
if (err) {
console.log(JSON.stringify(params))
reject(new Error(`Error in assuming cross-account IAM role: ${err}`));
} else {
const accessKeyId = data.Credentials?.AccessKeyId;
const secretAccessKey = data.Credentials?.SecretAccessKey;
const sessionToken = data.Credentials?.SessionToken;
const expiration = data.Credentials?.Expiration;
if (!accessKeyId || !secretAccessKey || !sessionToken || !expiration) {
reject(new Error('One or more AWS credentials are undefined. Unable to proceed.'));
} else {
resolve({
accessKeyId,
secretAccessKey,
sessionToken,
expiration
})
}
}
})
})
} The error I get is the following:
Error [CredentialsError]: Missing credentials in config, if using AWS_CONFIG_FILE, set AWS_SDK_LOAD_CONFIG=1
at credError (webpack://behavior-producers/node_modules/aws-sdk/lib/config.js:400:40)
at getCredentials (webpack://behavior-producers/node_modules/aws-sdk/lib/config.js:441:14)
at apply (webpack://behavior-producers/node_modules/aws-sdk/lib/event_listeners.js:111:28)
at callListeners (webpack://behavior-producers/node_modules/aws-sdk/lib/sequential_executor.js:102:18)
at call (webpack://behavior-producers/node_modules/aws-sdk/lib/sequential_executor.js:78:10)
at emit (webpack://behavior-producers/node_modules/aws-sdk/lib/request.js:686:14)
at call (webpack://behavior-producers/node_modules/aws-sdk/lib/request.js:22:10)
at runTo (webpack://behavior-producers/node_modules/aws-sdk/lib/state_machine.js:14:12)
at runTo (webpack://behavior-producers/node_modules/aws-sdk/lib/request.js:406:15)
at constructor.send (webpack://behavior-producers/node_modules/aws-sdk/lib/request.js:370:10) {
code: 'CredentialsError',
time: 2024-02-04T12:43:55.754Z,
originalError: {
message: 'No credentials to load',
code: 'CredentialsError',
time: 2024-02-04T12:43:55.754Z
}
I have also tried setting lambda environment variable AWS_SDK_LOAD_CONFIG=1 but I still get the above error. I am out of ideas here, any thoughts on this would be helpful. thanks.