Cross-Account and Cross-Region Access

Accessing resources in another account or region

  2 minute read  

LocalStack automatically namespaces all resources based on the account ID and, in some cases, the region. However, there are certain resource types that can be accessed across multiple accounts or regions. This document provides information to help design such setups.

Cross-Account

Resources that can be accessed across multiple accounts are always identified by their Amazon Resource Names (ARNs). The full list of resources and operations that allow cross-account access are listed below.

EC2 Peering

It is possible to create peered VPCs and transit gateway peering attachments that are in a different region or account than the requester. Ensure that the PeerRegion and PeerOwnerId arguments are correctly set when creating these resources.

KMS keys

  • CreateGrant
  • Decrypt
  • DescribeKey
  • Encrypt
  • GenerateDataKey
  • GenerateDataKeyPair
  • GenerateDataKeyPairWithoutPlaintext
  • GenerateDataKeyWithoutPlaintext
  • GenerateMac
  • GetKeyRotationStatus
  • GetPublicKey
  • ListGrants
  • RetireGrant
  • RevokeGrant
  • Sign
  • Verify
  • VerifyMac

Lambda functions and layers

  • AddLayerVersionPermission
  • CreateAlias
  • DeleteAlias
  • DeleteFunction
  • DeleteFunctionConcurrency
  • DeleteLayerVersion
  • GetAlias
  • GetFunction
  • GetFunctionConfiguration
  • GetLayerVersion
  • GetLayerVersionByArn
  • GetLayerVersionPolicy
  • GetPolicy
  • Invoke
  • ListAliases
  • ListLayerVersions
  • ListTags
  • ListVersionsByFunction
  • PublishVersion
  • PutFunctionConcurrency
  • RemoveLayerVersionPermission
  • TagResource
  • UntagResource
  • UpdateAlias
  • UpdateFunctionCode

S3 buckets

Like AWS, LocalStack S3 has a bucket namespace which is shared by all accounts. This means that the bucket name has to be globally unique.

  • GetObject
  • ListObjects
  • PutObject

SNS topics

  • AddPermission
  • DeleteTopic
  • GetTopicAttributes
  • ListSubscriptionByTopic
  • Publish
  • RemovePermission
  • SetTopicAttributes
  • Subscribe

SQS queues

On AWS, all operations except AddPermission, CreateQueue, DeleteQueue, ListQueues, ListQueueTags, RemovePermission, SetQueueAttributes, TagQueue and UntagQueue allow cross-account access.

On LocalStack, all operations allow cross-account access.

Cross-Region

AWS provides individual API endpoints for each region, and typically, resources can only be accessed within their respective regions.

On the other hand, LocalStack operates on a unified API endpoint, allowing interactions with services across regions.


Last modified September 28, 2023: Add info on cross-account/region VPC peering (#829) (0c7765edb)