title: How to invoke AWS Lambda function in account B (this Lambda in VPC) from Lambda in account A (Lambda in VPC)
body: <p>What I did:</p>
  
  <ol>
  <li>I created a VPC Peering connection between these accounts</li>
  <li>Internet Gateways also attached to each VPC</li>
  <li>Route Tables also configured (to allow traffic from both sides)</li>
  </ol>
  
  <p>Case 1:</p>
  
  <p>I successfully tested invoking Lambda function (in VPC B) from another Lambda function (in VPC A) when these 2 VPCs are in same account.</p>
  
  <p>However, when I created a similar VPC (as VPC B) in another account (account B) I got the following error:</p>
  
  <blockquote>
    <p>"errorMessage": "An error occurred (AccessDeniedException) when calling the Invoke operation: User: arn:aws:sts::Account-A:assumed-role/role-for-vpc-peering-test/lambda1_in_vpc is not authorized to perform: lambda:InvokeFunction on resource: arn:aws:lambda:us-east-1:Account-B:function:lambda-vpc</p>
  </blockquote>
  
  <p>My trails:</p>
  
  <p>I created a cross-account IAM Role for account A in account B with the following permissions:</p>
  
  <p><a href="https://i.stack.imgur.com/Mue49.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/Mue49.png" alt="IAM Role"></a></p>
  
  <p>Then I added an inline policy for the role which is using Lambda in account A:</p>
  
  <p><a href="https://i.stack.imgur.com/aRh2f.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/aRh2f.png" alt="IAM Permissions"></a></p>
  
  <p>Added policy to above role only:</p>
  
  <pre><code>{
      "Version": "2012-10-17",
      "Statement": {
          "Effect": "Allow",
          "Action": "sts:AssumeRole",
          "Resource": "arn:aws:iam::Account B:role/role-for-Account-A"
      }
  }
  </code></pre>
  
  <p>So my questions is should I do anything else to invoke Lambda in account B from Lambda in account A?</p>
  
  <p>I think I am missing something in the cross-account role only (<code>access denied error</code>).</p>
  
  <p>lambda- A code:</p>
  
  <p>import json
  import boto3</p>
  
  <p>client = boto3.client('lambda')</p>
  
  <p>def lambda_handler(event, context):
      inputForInvoker = {'CustomerId': '123', 'Amount': 50 }</p>
  
  <pre><code>response = client.invoke(
      FunctionName='arn:aws:lambda:us-east-1:AccountB-id:function:lambda-vpc-peering',
      InvocationType='RequestResponse', # Event
      Payload=json.dumps(inputForInvoker)
      )
  
  responseJson = json.load(response['Payload'])
  
  print('\n')
  print(responseJson)
  print('\n')
  </code></pre>
  
  <p>Any suggestions?</p>
  
  <p>Assume role- in Account b is : have following Policies : 1. AWSLambdaBasicExecutionRole 
  2.trust-policy:</p>
  
  <pre><code>{
    "Version": "2012-10-17",
    "Statement": [
      {
        "Effect": "Allow",
        "Principal": {
          "AWS": "arn:aws:iam::Account-id-A:role/role-for-vpc-peering-test"
        },
        "Action": "sts:AssumeRole"
      }
    ]
  }. 
  </code></pre>
  
  <p>execution role - attached  this inline policy :</p>
  
  <pre><code>{
      "Version": "2012-10-17",
      "Statement": {
          "Effect": "Allow",
          "Action": "sts:AssumeRole",
          "Resource": "arn:aws:iam::Account-b-id:role/role-for-7691-4701-2358"
      }
  }
  </code></pre>
  
  <p>and updated my lambda function with  below mention code also.</p>
  
  <p>but still getting same error </p>
  
  <p>now lambdas are not in vpc.</p>