title: Dynamodb Cross-account put_item
body: <p>I have two AWS accounts (account A, and account B). Account A has an EC2 instance, and that instance wants to do a put item to a dynamodb located in account B. </p>
  
  <p>Since it is cross-account access, I created an IAM role on account B to allow account A to do put_item, an IAM role on account A to assume that role and attached the IAM role on the EC2 instance</p>
  
  <p>When I run my program, I get an error message saying that I am trying to use the assume role to put an item to a table that in the same account. (in my code i just sepcified the Account B table name)</p>
  
  <p>It seems that the instance doesn’t realize that the table is on account B even I have the assumerole setup. What am I missing here?</p>
  
  <p>I have also verified that I can put item using AWS CLI (after performing the STS call).</p>
  
  <p>Is there any Java API that I can to specify which dynamodb arn that I want to put the item to?</p>
  
  <p>Error message:</p>
  
  <pre><code>User: arn:aws:sts::ACCOUNT_A:assumed-role/Assume-role/INSTANCE_ID is not authorized to perform: dynamodb:PutItem on resource: arn:aws:dynamodb:us-east-1:ACCOUNT_A:table/TABLE_NAME (Service: AmazonDynamoDBv2; Status Code: 400; Error Code: AccessDeniedException)
  </code></pre>
  
  <p>Policy on account A:</p>
  
  <pre><code>{ 
  "Version": "2012-10-17", 
  "Statement": [ { 
  "Effect": "Allow", 
  "Action": [ "sts:AssumeRole", "sts:GetFederationToken" ], 
  "Resource": "arn:aws:iam::AccountA:role/PutItem" }, 
  
  { "Effect": "Allow", 
  "Action": [ "sts:DecodeAuthorizationMessage", "sts:GetAccessKeyInfo", "sts:GetCallerIdentity" ], 
  "Resource": "*" } ]
   }
  </code></pre>
  
  <p>Policy on Account B:</p>
  
  <pre><code>{ 
  "Version": "2012-10-17", 
  "Statement": [ { 
  "Sid": "VisualEditor0", 
  "Effect": "Allow", 
  "Action": [ "dynamodb:PutItem", "dynamodb:UpdateItem", "dynamodb:UpdateTable" ], 
  "Resource": "arn:aws:dynamodb:region:accB:table/table name" },
  
  { 
  "Sid": "VisualEditor1", 
  "Effect": "Allow", 
  "Action": "dynamodb:*", 
  "Resource": "*" } ] 
  }
  </code></pre>