Export DynamoDB to S3 to another account using Codebuild

Question

I've created a codebuild to run the following command.

      aws dynamodb export-table-to-point-in-time \
        --table-arn arn:aws:dynamodb:REDACTED:REDACTED:table/REDACTED \
        --s3-bucket REDACTED \
        --s3-bucket-owner REDACTED

I've also created a service-role and attached the following inline policy.

        {
            "Sid": "",
            "Effect": "Allow",
            "Action": [
                "s3:PutObject"
            ],
            "Resource": [
                "arn:aws:s3:::REDACTED/*",
                "arn:aws:s3:::REDACTED"
            ]
        }

Finally, I've updated the S3 bucket to allow the service-role to write to the bucket:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::REDACTED:role/service-role/REDACTED"
            },
            "Action": "s3:*",
            "Resource": [
                "arn:aws:s3:::REDACTED/*",
                "arn:aws:s3:::REDACTED"
            ]
        }
    ]
}

The codebuild invokes the command correctly, but the export fails because of permissions.

[Container] 2022/03/08 11:50:42 Running command aws dynamodb export-table-to-point-in-time \
  --table-arn arn:aws:dynamodb:REDACTED:REDACTED:table/REDACTED \
  --s3-bucket REDACTED \
  --s3-bucket-owner REDACTED
{
    "ExportDescription": {
        "ExportArn": "arn:aws:dynamodb:REDACTED:REDACTED:table/REDACTED/export/REDACTED",
        "ExportStatus": "IN_PROGRESS",
        "StartTime": "2022-03-08T11:50:46.714000+00:00",
        "TableArn": "arn:aws:dynamodb:REDACTED:REDACTED:table/REDACTED",
        "TableId": "REDACTED",
        "ExportTime": "2022-03-08T11:50:46.714000+00:00",
        "ClientToken": "REDACTED",
        "S3Bucket": "REDACTED",
        "S3BucketOwner": "REDACTED",
        "S3SseAlgorithm": "AES256",
        "ExportFormat": "DYNAMODB_JSON"
    }
}
[Container] 2022/03/08 11:50:46 Phase complete: BUILD State: SUCCEEDED

If I invoke from the AWS Console (i.e. as my user) I am able to export cross account. But using codebuild and the command above, it fails.

What am I missing?

Answer 1

I fixed this.

The issue was referencing the wrong accountId within the aws dynamodb export-table-to-point-in-time CLI command.