title: aws cross account dynamodb access with IAM role
body: <p>I have an aws ecs ec2 instance in one account and it is trying to access the dynamob db tables on another aws account. I am not using any aws access key and id,  instead using AWS iam role attached to the ec2 instance. </p>
  
  <p>This is a .net project and my appsettings.Staging.json is this. </p>
  
  <pre><code>{
    "aws": {
      "region": "ap-southeast-1"
    },
    "DynamoDbTables": {
      "BenefitCategory": "stag_table1",
      "Benefit": "stag_table2"
    },
    "Logging": {
      "LogLevel": {
        "Default": "Debug",
        "System": "Information",
        "Microsoft": "Information"
      }
    }
  }
  
  </code></pre>
  
  <p>Here is my inline policy attached to the "ecsInstanceRole" </p>
  
  <p>"xxxxxxxxxxxxx" >> this is the aws account on which the dynamodb table resides. </p>
  
  <pre><code>{
      "Version": "2012-10-17",
      "Statement": [
          {
              "Sid": "VisualEditor0",
              "Effect": "Allow",
              "Action": [
                  "dynamodb:PutItem",
                  "dynamodb:DescribeTable",
                  "dynamodb:DeleteItem",
                  "dynamodb:GetItem",
                  "dynamodb:Scan",
                  "dynamodb:Query",
                  "dynamodb:UpdateItem",
                  "dynamodb:DeleteTable",
                  "dynamodb:UpdateTable",
                  "dynamodb:GetRecords"
              ],
              "Resource": [
                  "arn:aws:dynamodb:ap-southeast-1:xxxxxxxxxxx:table/stag_table1",
                  "arn:aws:dynamodb:ap-southeast-1:xxxxxxxxxxx:table/stag_table2",
              ]
          },
          {
              "Sid": "VisualEditor1",
              "Effect": "Allow",
              "Action": [
                  "dynamodb:ListGlobalTables",
                  "dynamodb:ListTables"
              ],
              "Resource": "*"
          }
      ]
  }
  </code></pre>
  
  <p>In this set up the api is trying to connect to the table in the same account.  I have added the other aws account in the trusted entity in the role ecsInstanceRole still not working. </p>
  
  <p>is there any way the aws sdk or aws ecs/ec2 instance automatically find dynamodb table in the other aws account?</p>