title: Publish MQTT message to AWS IoT Core from Lambda on a different account
body: <p>I'm trying to publish MQTT message to AWS IoT Core from Lambda on a different account.</p>
  <p>Less assume that Account A is the one with the IoT core and account B is the one that has the lambda function.</p>
  <p>On Account A:
  I created the following  role type 'Another AWS account' using the account ID of B with the AWSIoTDataAccess policies:</p>
  <pre><code>{
      &quot;Version&quot;: &quot;2012-10-17&quot;,
      &quot;Statement&quot;: [
          {
              &quot;Effect&quot;: &quot;Allow&quot;,
              &quot;Action&quot;: [
                  &quot;iot:Connect&quot;,
                  &quot;iot:Publish&quot;,
                  &quot;iot:Subscribe&quot;,
                  &quot;iot:Receive&quot;,
                  &quot;iot:GetThingShadow&quot;,
                  &quot;iot:UpdateThingShadow&quot;,
                  &quot;iot:DeleteThingShadow&quot;
              ],
              &quot;Resource&quot;: &quot;*&quot;
          }
      ]
  }
  </code></pre>
  <p>On Account B:
  I have a lambda function nodejs</p>
  <pre><code> // Get the Cross account credentials
  const accessparams = new Promise((resolve, reject) =&gt; {
          const timestamp = (new Date()).getTime();
          const params = {
              RoleArn: 'arn:aws:iam::' + id + ':role/' + remoteRole,
              RoleSessionName: `be-descriptibe-here-${timestamp}`
          };
          sts.assumeRole(params, (err, data) =&gt; {
              if (err) reject(err);
              else {
                  resolve({
                      accessKeyId: data.Credentials.AccessKeyId,
                      secretAccessKey: data.Credentials.SecretAccessKey,
                      sessionToken: data.Credentials.SessionToken,
                  });
              }
          });
      });
  
  iot.remote = new AWS.IotData({ accessparams, endpoint: accountInfo.endpoint, region: 'ca-central-1', });
  
      var params = {
          topic: &quot;MyTopic&quot;,
          payload: 'payload',
          qos: 0
      };
  
   try {
          var result = await iot.remote.publish(params).promise();
          console.log('result', result);
          return buildResponse({ &quot;result&quot;: &quot;ok&quot; });
      } catch (err) {
          console.log(&quot;ERROR =&gt; &quot; + JSON.stringify(err));
          return buildErrorResponse(&quot;Error&quot;);
      }
  
  </code></pre>
  <p>I haven't been able to publish any data, I'm getting the error below, which looks like it never assumes the role for account A.</p>
  <pre><code>{
      &quot;message&quot;: &quot;The client used a Server Name Indication (SNI) that is not associated with this account.&quot;,
      &quot;code&quot;: &quot;ForbiddenException&quot;,
      &quot;time&quot;: &quot;2021-05-29T16:21:11.254Z&quot;,
      &quot;requestId&quot;: &quot;c2f78026-cc64-091b-8b66-0322c26a26bb&quot;,
      &quot;statusCode&quot;: 403,
      &quot;retryable&quot;: false,
      &quot;retryDelay&quot;: 84.76771000356665
  }
  </code></pre>
  <p>Any comment or suggestion will more than appreciated.</p>
  <p>Thanks in advance,</p>
  <p>Daniel</p>