Question

A company has an Amazon S3 bucket in Account A (111111111111) that must be read by an application running on EC2 instances in Account B (222222222222). The EC2 instances use an instance profile role named AppRole. The security team requires that no additional IAM role be assumed and that access be granted with the least possible cross-account trust configuration. Which approach correctly grants the EC2 application read access to the bucket?

Accepted Answer

Add a bucket policy in Account A that allows s3:GetObject with a Principal of the AppRole ARN in Account B, and ensure AppRole's identity policy in Account B also permits s3:GetObject on the bucket.

Answer

Attach an identity policy to AppRole in Account B allowing s3:GetObject on the bucket; no changes are needed in Account A because IAM identity policies grant cross-account access automatically.

Answer

Create a new role in Account A with an S3 read policy and configure AppRole to call sts:AssumeRole into that Account A role before accessing the bucket.

Answer

Add a bucket policy in Account A that allows s3:GetObject with a Principal of the Account B root ARN, and rely solely on that bucket policy without any identity policy in Account B.