Question

A data engineering team stores curated datasets in an S3 bucket encrypted with a customer managed KMS key in Account A. A partner team in Account B is granted access to the bucket via a bucket policy, and their IAM role has s3:GetObject permission on the bucket. However, when the partner role attempts to download objects, it receives an AccessDenied error even though the S3 bucket policy allows the role. What is the MOST likely cause and correct fix?

Accepted Answer

The KMS key policy does not grant the Account B role kms:Decrypt permission; update the key policy (and the role's IAM policy) to allow the role to use the key.

Answer

The bucket must use SSE-S3 instead of SSE-KMS for cross-account access; change the default encryption to Amazon S3 managed keys.

Answer

S3 Block Public Access is enabled; disable it so the partner account can reach the objects.

Answer

The partner role needs s3:ListBucket permission; add it so GetObject can succeed.