title: AWS Cross Account SNS Publish
body: <p>We have two accounts 111111111111 and 222222222222.</p>
  
  <p>Requirement - Account 111111111111 will create a snapshot of a RDS on a daily basis. Once the snapshot is taken, we want account 111111111111 to publish to the SNS topic created in account 222222222222. Once Account 222222222222 receives the notification it runs a Lambda function.</p>
  
  <p>I have attached the following policy to the topic created in account 222222222222</p>
  
  <pre><code>     "Sid":"RestoreRDSEng_topic_publish",
       "Effect":"Allow",
       "Principal":{
          "AWS":"111111111111"
       },
       "Action":"sns:Publish",
       "Resource":"arn:aws:sns:us-east-1:222222222222:RestoreRDSEng",
       "Condition":{
          "StringEquals":{
             "AWS:SourceAccount":"222222222222"
          },
  
       }
    } 
  </code></pre>
  
  <p>I am receiving the following error when account 111111111111 is trying to publish to 222222222222</p>
  
  <p><strong>*"message": "AuthorizationError: User: arn:aws:sts::************assumed-role/tf-rds_eventhandler/tf-rds_eventhandler is not authorized to perform: SNS:Publish on resource: arn:aws:sns:us-east-1:xxxxxxxxxxxx:RestoreRDSEng\n\tstatus code: 403, request id: 098f4647-c9ad-51fe-9bc3-17b45deef60e"*</strong></p>
  
  <p>Questions:</p>
  
  <ol>
  <li><p>Is there anything wrong in this approach?</p></li>
  <li><p>Should I create a role in account 222222222222 with trusted access to 111111111111?</p></li>
  <li><p>Any other suggestions would be appreciated.</p></li>
  </ol>