CODEWITHSUNDEEP
pythonamazon-web-servicesaws-lambdaamazon-iam
Sawyer Merchant
Sawyer Merchant

Reputation: 1303

Invoke an AWS lambda across regions

I have three lambda functions: boss, worker1, worker2. When using boto3.client.invoke I am able to call worker1 from boss. These two are in the same region.
worker2 is in a separate region. When attempting to call worker2 from boss the following error returns:
"An error occurred (ResourceNotFoundException) when calling the Invoke operation: Functions from 'us-east-1' are not reachable in this region ('us-west-2')" . boss has an execution role with the following permission: 

{
"Version": "2012-10-17",
"Statement": [
    {
        "Action": [
            "lambda:InvokeFunction"
        ],
        "Effect": "Allow",
        "Resource": "arn:aws:lambda:*:*:*"
    }
]
}

Please help clarify how permissions need to be conveyed for this to work. Thanks

Edit: master and worker1 are in us-west-2 and worker1 is in us-east-1.
Here is the code used to invoke worker from master: 

def lambda_handler(event, context):
function_name = "arn:aws:lambda:us-east-1-...:function:worker_2"
lambda_client = boto3.client('lambda')
payload = json.dumps({"body-json": "payload string")
response = lambda_client.invoke(
    FunctionName = function_name,
    Payload = payload
)
response_payload = response['Payload'].read()
response_arr = json.loads(response_payload)
return response_arr['answer']

Upvotes: 19

Views: 31434

Answers (3)

Dhanushka P Arachchige
Dhanushka P Arachchige

Reputation: 31

let lambda = new AWS.Lambda({region: region}) and after this you should do lambda.invoke which will do the trick!

Upvotes: 2

Sawyer Merchant
Sawyer Merchant

Reputation: 1303

Thank you everyone for the input. @Michael-sqlbot's comment about the AWS client library defaulting to sending requests to the local region is what helped me find the solution. For Python, the library is boto3. Having read the docs it was not clear how to set the region. It was this blog post that provided the (simple) answer: 

client = boto3.client('lambda', region_name='us-west-2')

You are right Michael that the use case for one lambda to another between regions is convoluted. I'll leave this answer here in case any others who are new to boto3 encounter the same error when trying to get other resources (lambda to ec2, lambda to s3, etc) to work across regions.
Thanks

Upvotes: 25

Ele
Ele

Reputation: 33736

You need to set the region of worker2 lambda function as follow:

arn:aws:lambda:us-east-1-...:function:worker_2

So, the code would look:

function_name = "arn:aws:lambda:us-east-1-...:function:worker_2"
lambda_client = boto3.client('lambda')
payload = json.dumps({"body-json": "payload string")
response = lambda_client.invoke(
    FunctionName = function_name,
    Payload = payload
)

Great, now you need to grant permissions to your Lambda master through the IAM role of master lambda function.

+ suggestion

You could create an API Gateway endpoint who executes a lambda function in region us-east-1. This endpoint could be executed only with a specific API Key to provide a layer of security.

And from master lambda function execute a request to that endpoint.

Resource

Upvotes: -1

Related Questions