AWS lambda documentation change
Summary
Added documentation for cross-account event source mappings between DynamoDB streams and Lambda functions, including requirements for resource-based policies and cross-account stream ARN configuration.
Security assessment
The changes introduce documentation for cross-account access using DynamoDB resource-based policies, which is a security feature enabling controlled access between accounts. There is no evidence of a specific security vulnerability being fixed; rather, this documents proper security practices for cross-account resource sharing.
Diff
diff --git a/lambda/latest/dg/services-dynamodb-eventsourcemapping.md b/lambda/latest/dg/services-dynamodb-eventsourcemapping.md index 220aa83ee..4ed8a9511 100644 --- a//lambda/latest/dg/services-dynamodb-eventsourcemapping.md +++ b//lambda/latest/dg/services-dynamodb-eventsourcemapping.md @@ -4,0 +5,2 @@ +Cross-account mappings + @@ -8,0 +11,2 @@ Create an event source mapping to tell Lambda to send records from your stream t +You can configure event source mappings to process records from a stream in a different AWS account. To learn more, see Creating a cross-account event source mapping. + @@ -78,0 +83,12 @@ To manage the event source configuration later, choose the trigger in the design +## Creating a cross-account event source mapping + +Amazon DynamoDB now supports [resource-based policies](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/access-control-resource-based.html). With this capability, you can process data from a DynamoDB stream in one AWS account with a Lambda function in another account. + +To create an event source mapping for your Lambda function using a DynamoDB stream in a different AWS account, you must configure the stream using a resource-based policy to give your Lambda function permission to read records. To learn how to configure your stream for cross-account access, see [Share access with cross-account Lambda functions](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/rbac-cross-account-access.html#rbac-analyze-cross-account-lambda-access) in the _Amazon DynamoDB Developer Guide_. + +Once you have configured your stream with a resource-based policy that gives your Lambda function the required permissions, create the event source mapping with your cross-account stream ARN. You can find the stream ARN under the table's **Exports and streams** tab in the cross-account DynamoDB console. + +When using the Lambda console, paste the stream ARN directly into the DynamoDB table input field in the event source mapping creation page. + +**Note:** Cross-region triggers are not supported. +