How to access S3 bucket created in us-west-2 region from us-east-1 account?

Question

I have account A with us-east-1 region having IAM role rt-profileRole and my application setup. Account B created S3 bucket in us-west-1 and us-west-2.

I am trying to list object using aws cli with role rtprofile. both bucket have similar bucket policy as below resource having correct bucket arn of bucket to which policy attach.

Problem is I can list object from bucket created in us-west-1 using aws s3 ls from my local system. But I got error when I try same for bucket created in us-west-2 An error occurred (AccessDenied) when calling the ListObjectsV2 operation: Access Denied

I tired with multiple bucket and concluded that using account A role

I can access bucket of Account A created in us-east-1
I can access bucket of account B created in us-west-1
I can not access bucket of account B created in us-west-2.

Please help me to understand what wrong with west-2 region here.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "DelegateS3Access",
            "Effect": "Allow",
            "Principal": {
                "AWS": [
                    "arn:aws:iam::AccountA:role/rt-profileRole"
                ]
            },
            "Action": "s3:*",
            "Resource": [
                "arn:aws:s3:::bucket-name/*",
                "arn:aws:s3:::bucket-name"
            ]
        }
    ]
}

Have you checked bucket names? All three buckets will have different names. Mistake in names could be possible. — Marcin

Chris Williams Chris Williams · Accepted Answer · 2020-07-21T07:17:24

Once you add the bucket policy to the bucket, you must also ensure the role has privileges in its IAM policy.

In addition if you're in an AWS organisation ensure there is no SCP on Account A that is prevent actions within a specific region.

Regarding the bucket policy you should scope this down to the permissions you want the bucket to use once you're confirmed it works (its currently every S3 action on the bucket including deletes).

How to access S3 bucket created in us-west-2 region from us-east-1 account?

1 Answers