I am trying to create a cross account macro which will will be used in Cloudformation. According to the doc - https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/template-macros.html we have to create macros in different accounts but the underlying lambda can be re-used by making it cross account accessible.

Sample Example:

Account A

In Account_A(2 22222222222) I have created a lambda function "TestMacroFunction" which is used in the macro.

I have added following trust policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "lambda.amazonaws.com",
        "AWS": "arn:aws:iam::483427547108:role/service-role/TestLambdaInvoker-role-lu7aa94t"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

Account B

In Account_B(111111111111) which will have a cloudformation stack for Macro and another stack which will use the macro.

CFN for macro

{
  "AWSTemplateFormatVersion": "2010-09-09",
  "Resources": {
    "SageMakerEndpointAlarmsMacro": {
      "Type": "AWS::CloudFormation::Macro",
      "Properties": {
        "Name": "ExternalMacro",
        "FunctionName": "arn:aws:lambda:us-east-2:111111111111:function:TestMacroFunction",
        "LogGroupName": "MacroLogGroup"
      }
    }
  }
}

CFN for Stack using macro:

{
  "AWSTemplateFormatVersion": "2010-09-09",
  "Transform": [
    "ExternalMacro"
  ],
  "Resources": {
    "TestBucket": {
      "Type": "AWS::S3::Bucket",
      "Properties": {}
    }
  }
}

While running the CFN stack I provide a Role which has following policy attached:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "lambda:InvokeFunction"
            ],
            "Resource": "arn:aws:lambda:us-east-2:111111111111:function:TestMacroFunction",
            "Effect": "Allow"
        }
    ]
}

But still I am getting error in cloudformation. The transform in not executing. Also the lambda function is not getting invoked.

Has anyone created a lambda which is used by macros in other account?