Cross-account access to S3 buckets using Resource-based policies and IAM policies

• Use bucket policies to manage cross-account control and audit the S3 object's permissions.

• If you apply a bucket policy at the bucket level, you can define who can access (Principal element), which objects they can access (Resource element), and how they can access (Action element).

• Applying a bucket policy at the bucket level allows you to define granular access to different objects inside the bucket.

1. Create an S3 bucket in Account A. 2. Create an IAM role or user in Account B. 3. Give the IAM role or user in Account B permission to download and upload objects to and from a specific S3 bucket with this IAM policy and also gives the IAM role or user in Account B permissions to call PutObjectAcl to grant object permissions to the bucket owner:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:PutObject",
                "s3:PutObjectAcl"
            ],
            "Resource": "arn:aws:s3:::AccountABucketName/*"

        }
    ]
}

4. Configure the bucket policy for Account A to grant permissions to the IAM role or user that you created in Account B and use this bucket policy to grant a user the permissions to GetObject and PutObject for objects in a bucket owned by Account A:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::AccountB:user/AccountBUserName"
            },
            "Action": [
                "s3:GetObject",
                "s3:PutObject",
                "s3:PutObjectAcl"
            ],
            "Resource": [
                "arn:aws:s3:::AccountABucketName/*"
            ]
        }
    ]
}