Question

A company runs a KMS-encrypted S3 bucket in account A (111111111111). A data-processing application running on an EC2 instance in account B (222222222222) uses an IAM role to read objects. The security team confirms the S3 bucket policy in account A grants s3:GetObject to the account B role's ARN, and the KMS key policy in account A grants kms:Decrypt to the same role ARN. However, the application receives AccessDenied errors when downloading objects. The IAM role in account B currently has no attached identity-based policy for S3 or KMS. What must be changed to allow the download to succeed?

Accepted Answer

Attach an identity-based policy to the account B role granting s3:GetObject and kms:Decrypt on the relevant resources, in addition to the existing resource-based policies.

Answer

Add a Principal element referencing the account B role to the account A KMS key grant instead of the key policy.

Answer

Configure an SCP in account B that allows s3:GetObject and kms:Decrypt for the role.

Answer

Enable S3 Block Public Access exceptions on the account A bucket so the cross-account role is treated as trusted.