title: Not able to assume role via lambda function - Python
body: <p>Hi I am having this bizarre problem since yesterday. I have a python module web_token.py when I try to run it manually on pycharm and print request_url it works completely fine and outputs the requested_url. But when I zip my web_token.py and fetch_accounts.py together and upload it to lambda function it gives me following error - </p>
  
  <blockquote>
    <p>An error occurred (AccessDenied) when calling the AssumeRole operation: User: arn:aws:sts::5398XXXXXXX:assumed-role/sandbox-amp_sandbox-dev/sandbox-dev-amp_sandbox is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::4540XXXXXXXX:role/AMPSandbox</p>
  </blockquote>
  
  <p>I even tried giving it FullAdministrativeAccess but still it dosent seem to work. Although I am able to generate requested_url when running the web_token.py in stanalone mode in pycharm. Can someone please provide some guidance will really appreciate it.</p>
  
  <p>Code snippet from </p>
  
  <blockquote>
    <p>retrieve_accounts.py</p>
  </blockquote>
  
  <pre><code>import boto3
  
  import web_token
  
  
  def get_account(event, context):
      client = boto3.client('dynamodb')
      NameID = "test@orgz.com"
      ManagerEmail = "test1@orgaz.com"
      response = client.scan(
          TableName='Sandbox-Users',
          ScanFilter={
              'NameID': {
                  'AttributeValueList': [
                      {
                          'S': NameID,
                      },
                  ],
                  'ComparisonOperator': 'EQ'
              }
          }
      )
      return web_token.request_url
  </code></pre>
  
  <blockquote>
    <p>web_token.py</p>
  </blockquote>
  
  <pre><code>import httplib
  import urllib, json
  import boto3
  
  client = boto3.client('sts')
  assumed_role_object = client.assume_role(
      RoleArn="arn:aws:iam::4540XXXXXXXX:role/AMPSandboxRole",
      RoleSessionName="AssumeRoleSession"
  )
  
  # Step 3: Format resulting temporary credentials into JSON
  json_string_with_temp_credentials = '{'
  json_string_with_temp_credentials += '"sessionId":"' + assumed_role_object.get("Credentials").get("AccessKeyId") + '",'
  json_string_with_temp_credentials += '"sessionKey":"' + assumed_role_object.get("Credentials").get("SecretAccessKey") + '",'
  json_string_with_temp_credentials += '"sessionToken":"' + assumed_role_object.get("Credentials").get("SessionToken") + '"'
  json_string_with_temp_credentials += '}'
  
  # Step 4. Make request to AWS federation endpoint to get sign-in token. Construct the parameter string with
  # the sign-in action request, a 12-hour session duration, and the JSON document with temporary credentials
  # as parameters.
  request_parameters = "?Action=getSigninToken"
  request_parameters += "&amp;SessionDuration=43200"
  request_parameters += "&amp;Session=" + urllib.quote_plus(json_string_with_temp_credentials)
  request_url = "/federation" + request_parameters
  
  conn = httplib.HTTPSConnection("signin.aws.amazon.com")
  conn.request("GET", request_url)
  r = conn.getresponse()
  # Returns a JSON document with a single element named SigninToken.
  signin_token = json.loads(r.read())
  
  request_parameters = "?Action=login"
  request_parameters += "&amp;Issuer=sandbox.com"
  request_parameters += "&amp;Destination=" + urllib.quote_plus("https://console.aws.amazon.com/")
  request_parameters += "&amp;SigninToken=" + signin_token["SigninToken"]
  request_url = "https://signin.aws.amazon.com/federation" + request_parameters
  </code></pre>
  
  <p>UPDATE :
  I have two policies attached to sandbox-amp_sandbox-dev role- </p>
  
  <p><strong>InfraLoggingPolicy[in 5398XXXXXXX]</strong></p>
  
  <pre><code>    {
      "Version": "2012-10-17",
      "Statement": [
          {
              "Action": [
                  "sqs:SendMessage",
                  "sqs:SendMessageBatch"
              ],
              "Resource": "arn:aws:sqs:*:131703196249:org-logging-prod",
              "Effect": "Allow"
          },
          {
              "Action": [
                  "ec2:DescribeInstances",
                  "logs:CreateLogGroup",
                  "logs:CreateLogStream",
                  "logs:PutLogEvents"
              ],
              "Resource": "*",
              "Effect": "Allow"
          },
          {
              "Effect": "Allow",
              "Action": "s3:*",
              "Resource": [
                  "arn:aws:s3:::em-log-intake-us-east-1-prod/*",
                  "arn:aws:s3:::em-log-intake-us-west-2-prod/*"
              ]
          }
      ]
  }
  </code></pre>
  
  <p><strong>sandbox-amp_sandbox-policy-dev[in 5398XXXXXXX]</strong></p>
  
  <pre><code>    {
      "Version": "2012-10-17",
      "Statement": [
          {
              "Sid": "",
              "Effect": "Allow",
              "Action": "dynamodb:*",
              "Resource": "arn:aws:dynamodb:*:*:*"
          }
      ]
  }
  </code></pre>
  
  <p>UPDATE 2.0
  These above policies are from my account number 5398XXXXXXX. I have following role in 4540XXXXXXXX account AMPSandboxRole under which I have following policies </p>
  
  <p><strong>AssumeRole[in 4540XXXXXXXX]</strong></p>
  
  <pre><code>    {
      "Version": "2012-10-17",
      "Statement": [
          {
              "Effect": "Allow",
              "Resource": "arn:aws:iam::*:role/AMPSandboxRole",
              "Action": "sts:AssumeRole"
          }
      ]
  }
  </code></pre>
  
  <p><strong>organizationaccess in [4540XXXXXXXX]</strong></p>
  
  <pre><code>{
      "Version": "2012-10-17",
      "Statement": [
          {
              "Effect": "Allow",
              "Action": [
                  "organizations:Describe*",
                  "organizations:List*",
                  "organizations:CreateAccount",
                  "organizations:MoveAccount"
              ],
              "Resource": "*"
          },
          {
              "Effect": "Allow",
              "Action": [
                  "organizations:MoveAccount"
              ],
              "Resource": "arn:aws:organizations::454084028794:root/o-eyec2h6qr0/r-ekzh"
          },
          {
              "Effect": "Allow",
              "Action": [
                  "organizations:*"
              ],
              "Resource": "arn:aws:organizations::45xxxxxxxxxx:ou/o-eyec2h6qr0/ou-ekzh-x2xcsupl"
          }
      ]
  }
  </code></pre>
  
  <p>UPDATE 3.0
  <strong>Trust relationship in 45xxxxxxxxxx</strong></p>
  
  <pre><code> {
    "Version": "2012-10-17",
    "Statement": [
      {
        "Effect": "Allow",
        "Principal": {
          "AWS": "arn:aws:iam::53xxxxxxxxxx:root"
        },
        "Action": "sts:AssumeRole"
      }
    ]
  }
  </code></pre>