How to assume a cross account role in AWS lambda using javascript sdk v2?

55 views Asked by At

I have an AWS lambda that needs to access s3 resource in another AWS account. The lambda execution role has the following policies attached to it:

eg: cross account role is cross-account-role-staging

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "logs:PutLogEvents",
                "logs:CreateLogStream"
            ],
            "Effect": "Allow",
            "Resource": "arn:aws:logs:us-east-1:<AWSAccountId>:log-group:/aws/lambda/*",
            "Sid": ""
        }
    ]
}

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": "sts:AssumeRole",
            "Effect": "Allow",
            "Resource": "arn:aws:iam::<CrossAWSAccountId>:role/cross-account-role-staging",
            "Sid": ""
        }
    ]
}

I use the following function to get cross account credentials using STS:

export async function getCrossAccountCredentials(roleArn: string): Promise<Credentials> {
const sts = new STS()

return new Promise((resolve, reject) => {
    const params = {
        RoleArn: roleArn,
        RoleSessionName: roleSessionName
    }
    sts.assumeRole(params, (err, data) => {
        if (err) {
            console.log(JSON.stringify(params))
            reject(new Error(`Error in assuming cross-account IAM role: ${err}`));
        } else {
            const accessKeyId = data.Credentials?.AccessKeyId;
            const secretAccessKey = data.Credentials?.SecretAccessKey;
            const sessionToken = data.Credentials?.SessionToken;
            const expiration = data.Credentials?.Expiration;

            if (!accessKeyId || !secretAccessKey || !sessionToken || !expiration) {
                reject(new Error('One or more AWS credentials are undefined. Unable to proceed.'));
            } else {
                resolve({
                    accessKeyId,
                    secretAccessKey,
                    sessionToken,
                    expiration
                })
            }
        }
    })
})

} The error I get is the following:

Error [CredentialsError]: Missing credentials in config, if using AWS_CONFIG_FILE, set AWS_SDK_LOAD_CONFIG=1
    at credError (webpack://behavior-producers/node_modules/aws-sdk/lib/config.js:400:40)
    at getCredentials (webpack://behavior-producers/node_modules/aws-sdk/lib/config.js:441:14)
    at apply (webpack://behavior-producers/node_modules/aws-sdk/lib/event_listeners.js:111:28)
    at callListeners (webpack://behavior-producers/node_modules/aws-sdk/lib/sequential_executor.js:102:18)
    at call (webpack://behavior-producers/node_modules/aws-sdk/lib/sequential_executor.js:78:10)
    at emit (webpack://behavior-producers/node_modules/aws-sdk/lib/request.js:686:14)
    at call (webpack://behavior-producers/node_modules/aws-sdk/lib/request.js:22:10)
    at runTo (webpack://behavior-producers/node_modules/aws-sdk/lib/state_machine.js:14:12)
    at runTo (webpack://behavior-producers/node_modules/aws-sdk/lib/request.js:406:15)
    at constructor.send (webpack://behavior-producers/node_modules/aws-sdk/lib/request.js:370:10) {
  code: 'CredentialsError',
  time: 2024-02-04T12:43:55.754Z,
  originalError: {
    message: 'No credentials to load',
    code: 'CredentialsError',
    time: 2024-02-04T12:43:55.754Z
  }

I have also tried setting lambda environment variable AWS_SDK_LOAD_CONFIG=1 but I still get the above error. I am out of ideas here, any thoughts on this would be helpful. thanks.

0

There are 0 answers