Question

A company runs an SNS topic in Account A. A Lambda function in Account B, running under an execution role, must be able to publish messages to that SNS topic. The security team wants the topic owner (Account A) to remain in control of exactly which external principals can publish, without Account A administrators needing to modify anything in Account B. Which approach satisfies these requirements?

Accepted Answer

Attach a resource-based policy to the SNS topic in Account A that grants sns:Publish to the Lambda execution role ARN in Account B, and grant the same action in the role's identity policy in Account B.

Answer

Add an identity-based policy in Account A that allows the Account B Lambda role to publish to the topic.

Answer

Create an IAM user in Account A with publish permissions and embed its long-term access keys in the Lambda function's environment variables.

Answer

Enable cross-region replication on the SNS topic so the Lambda function in Account B automatically receives publish permissions.