Question

A developer builds a Lambda function in Account A that must read objects from an S3 bucket owned by Account B. The Lambda execution role already has an identity-based policy allowing s3:GetObject on the target bucket ARN. However, calls still fail with AccessDenied. The bucket is not using default encryption or ACL restrictions. What must the developer do to grant access following AWS cross-account best practices?

Accepted Answer

Add a bucket policy (resource-based policy) in Account B that allows the Account A Lambda role principal to perform s3:GetObject on the bucket.

Answer

Attach an additional identity-based policy with a Deny override removed to the Lambda role in Account A.

Answer

Enable S3 Block Public Access in Account B and make the objects public-read.

Answer

Recreate the Lambda function in Account B so it and the bucket share the same account.