A media company has a multi-account AWS environment in the us-east-1 Region. The company has an Amazon Simple Notification Service (Amazon SNS) topic in a production account that publishes…

To allow cross-account invocation, the AWS Lambda function in the administrator account must have a resource policy (permissions policy) that explicitly grants permission to the Amazon SNS service principal (sns.amazonaws.com) from the production account's SNS topic to invoke that specific Lambda function.

Implementing an Amazon SQS queue in the administrator account as an intermediary between SNS and Lambda is not strictly necessary for direct SNS-to-Lambda invocation across accounts. Direct invocation is possible with proper IAM policies and would introduce additional components and overhead.

The Amazon SNS topic in the production account requires a topic policy that explicitly grants permission to the AWS Lambda service principal from the administrator account (or a role associated with it) to subscribe to the topic. This policy enables the cross-account subscription necessary for the Lambda function to be invoked by the SNS topic messages.

While Amazon EventBridge can route events, for a direct SNS topic to Lambda cross-account invocation, configuring the appropriate IAM policies on both the SNS topic and the Lambda function is the most direct and required solution, rather than introducing EventBridge as an intermediary event bus.

Storing performance metrics in an Amazon S3 bucket and processing them is a different data ingestion and processing strategy that does not address the specific requirement of having an SNS topic in one account directly invoke a Lambda function in another account for real-time notification processing.