title: How to narrow down scope of AWS Kinesis cross account role
body: <p>So we create AWS kinesis in account A and create the role with only putRecord permission and then we give the role to account B where their lambda assumes the role and accordingly sends the data in.</p>
  <p>But the problem here is the trust policy which is having root access and anyone in account B can assume the role and start pushing data</p>
  <pre><code>{
    &quot;Version&quot;: &quot;2012-10-17&quot;,
    &quot;Statement&quot;: [
      {
        &quot;Effect&quot;: &quot;Allow&quot;,
        &quot;Principal&quot;: {
          &quot;AWS&quot;: &quot;arn:aws:iam::ACCOUNT2:root&quot;
        },
        &quot;Action&quot;: &quot;sts:AssumeRole&quot;,
        &quot;Condition&quot;: {}
      }
    ]
  }
  </code></pre>
  <p>Can we reduce the scope to Account B particular service (lambda function) and no other should service should push data?</p>