title: Creating a cross account IAM Lambda role using CDK
body: <p>In my scenario I have 2 accounts (11111111, 22222222) that need to+ invoke a lambda in a 3rd account: 33333333. The lambdas in the 3rd account will be invoked from lambdas in the first 2.</p>
  <p>The lambdas in 3rd account are created on the fly but I need to give them a role which I wish to create using CDK (which I will do using 3rd account creds - no cross account stuff here).</p>
  <p>I am following the instructions <a href="https://blog.e-sainc.com/blog/2018-04-17/lambda-cross-acct-access/" rel="nofollow noreferrer">here</a> - invoking the lambda using STS seems straightforward. What I am not fully clear on is how to define the 3rd account role in cdk.</p>
  <p>Here's my stack:</p>
  <pre><code>
  export class ModuleIAMStack extends Stack {
    constructor(scope: Construct, id: string, props?: StackProps) {
      super(scope, id, props)
  
      const lambdaModuleRole = new Role(this, 'moduleRole', {
        roleName: 'moduleRole',
        assumedBy: new AccountPrincipal({ accountId: '111111111' }),
        managedPolicies: [ManagedPolicy.fromAwsManagedPolicyName('service-role/AWSLambdaBasicExecutionRole')] // My lambdas in 3X... will not need to access any resources so this should be enough to execute
      })
    }
  }
  
  </code></pre>
  <p>I am unclear on the <code>assumedBy</code> line. Is <code>AccountPrincipal</code> the correct entry? and if so how do I enter the 22222222 account?</p>