Provide cross-account access to an S3 bucket

README.md

It's somewhat confusing to provide S3 access to an IAM role from another AWS account. The thing to remember is this: you need to provide access from both sides. In other words, you need to set the bucket resource policy and attach a regular IAM policy to the role.

It's kind of like how, when you want to go to your friend's house, you need permission from both moms. :)

See "Resource-based policies and IAM policies".

bucket-resource-policy.json

{
    "Version": "2008-10-17",
    "Statement": [
        {
            "Sid": "CrossAccountRoleAccess",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::ACCOUNT_ID:role/ROLE_NAME"
            },
            "Action": "s3:*",
            "Resource": "arn:aws:s3:::BUCKET_NAME/*"
        }
    ]
}

role-iam-policy.json

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "s3:*",
            "Resource": "arn:aws:s3:::BUCKET_NAME/*"
        }
    ]
}