Question

A company has an S3 bucket in Account A (the resource owner). A role in Account B needs to read objects from this bucket. The security team configures the following: the bucket policy in Account A grants s3:GetObject to the Account B role's ARN; the role in Account B has an identity-based policy allowing s3:GetObject on the bucket; and Account B is in an AWS Organization with an SCP that denies all s3:* actions except s3:ListBucket. When the role in Account B attempts to download an object, the request is denied. What is the cause?

Accepted Answer

The SCP attached to Account B contains an explicit deny for s3:GetObject, and SCPs restrict the maximum permissions of principals in Account B regardless of resource-based or identity-based allows.

Answer

Cross-account access always requires an IAM role assumption via STS; a bucket policy cannot directly grant access to a role in another account.

Answer

The bucket policy in Account A must also be approved by an SCP in Account A before it can take effect for cross-account principals.

Answer

Because both the identity-based policy and the resource-based policy allow the action, access should be granted; the denial indicates an S3 Block Public Access misconfiguration.