Question

A company's data-analytics account (111111111111) needs read-only access to a specific prefix (reports/) in an S3 bucket owned by the reporting account (222222222222). Security requires that access be granted with least privilege and that credentials never leave AWS. The bucket has no public access and object ownership is set to bucket-owner-enforced (ACLs disabled). Which combination of policies correctly grants this access?

Accepted Answer

Add an S3 bucket policy in account 222222222222 that allows s3:GetObject on arn:aws:s3:::bucket/reports/* to the principal arn:aws:iam::111111111111:role/AnalyticsRole, and attach an identity policy to AnalyticsRole allowing s3:GetObject on the same resource.

Answer

Attach an identity policy to AnalyticsRole in account 111111111111 allowing s3:GetObject on the bucket; no changes are needed in account 222222222222 because IAM identity policies work across accounts.

Answer

Add a bucket policy in account 222222222222 granting s3:* to Principal "*" with a condition restricting aws:PrincipalOrgID, so any principal in the organization can read the reports.

Answer

Configure an S3 access control list (ACL) on the reports/ objects granting READ to the canonical ID of account 111111111111, and attach an identity policy to AnalyticsRole.