title: Invoking SNS from cross account using API Gateway
body: <p>I am having an API gateway end point in my AWS account which will invoke a SNS in another AWS account in same region.</p>
  
  <p>The access policy in API gateway in my account is like follows</p>
  
  <pre><code>{
  "Version": "2012-10-17",
  "Statement": [
      {
          "Sid": "VisualEditor0",
          "Effect": "Allow",
          "Action": "sns:Publish",
          "Resource": "arn:aws:sns:ap-southeast-1:604970532282:PublishSourceMsgTopic"
      }
  ]
  }
  </code></pre>
  
  <p>The sns arn : arn:aws:sns:ap-southeast-1:604970532282:PublishSourceMsgTopic belongs to another AWS account in same region.</p>
  
  <p>The json of the access policy configured in the above SNS is :</p>
  
  <pre><code>{
  "Version": "2008-10-17",
  "Id": "__default_policy_ID",
  "Statement": [
   {
    "Sid": "__default_statement_ID",
    "Effect": "Allow",
    "Principal": {
      "AWS": "*"
    },
    "Action": [
      "SNS:Publish",
      "SNS:RemovePermission",
      "SNS:SetTopicAttributes",
      "SNS:DeleteTopic",
      "SNS:ListSubscriptionsByTopic",
      "SNS:GetTopicAttributes",
      "SNS:Receive",
      "SNS:AddPermission",
      "SNS:Subscribe"
    ],
    "Resource": "arn:aws:sns:ap-southeast-1:604970532282:PublishSourceMsgTopic",
    "Condition": {
      "StringEquals": {
        "AWS:SourceOwner": "604970532282"
      }
    }
  },
  {
    "Sid": "__console_pub_0",
    "Effect": "Allow",
    "Principal": {
      "AWS": "arn:aws:iam::148445556582:root"
    },
    "Action": "SNS:Publish",
    "Resource": "arn:aws:sns:ap-southeast-1:604970532282:PublishSourceMsgTopic"
  }
  ]
   }
  </code></pre>
  
  <p>When I am invoking the API Gateway its showing the following error :</p>
  
  <pre><code>User: arn:aws:sts::148445556582:assumed-role/api_gateway_sns_role/BackplaneAssumeRoleSession is not 
  authorized to perform: SNS:Publish on resource: arn:aws:sns:ap-southeast- 
  1:604970532282:PublishSourceMsgTopic
  </code></pre>
  
  <p>I am able to invoke the SNS successfully if i am giving SNS topic which is configured in my AWS account.</p>
  
  <p>What am I missing here?</p>