CloudFormation、S3 存储桶访问跨账户 IAM 角色

Question

I have 2 accounts, s3_buck_acct and iam_acct . I want to provision IAM role from iam_acct to certain actions on the S3 bucket from s3_buck_acct .

Here is the CloudFormation template I came up with that ends up with error:

Resources:
  S3BucketTest:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: "cross-acct-permission-demo"
      LifecycleConfiguration:
        Rules:
        - Id: LifecycleExpRule 
          ExpirationInDays: '3650'
          Status: Enabled
      BucketEncryption: 
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256

  S3CURBucketPolicy: 
    Type: AWS::S3::BucketPolicy
    Properties: 
      Bucket: 
        !Ref S3BucketTest
      PolicyDocument: 
        Statement: 
          - Action:
                - 's3:ListBucket'
                - 's3:ListBucketMultipartUploads'
                - 's3:PutObject'
                - 's3:GetObject'
            Effect: "Allow"
            Resource: 
              - "arn:aws:s3:::cross-acct-perm-demo"
              - "arn:aws:s3:::cross-acct-perm-demo/*"
            Principal: "arn:aws:iam::1234567890:role/service-role/test-role-20190828T130835"
          - Action: "*"
            Resource: !Join [ '', ["arn:aws:s3:::", !Ref S3BucketTest, '/*']]
            Principal: '*'
            Effect: Deny
            Condition:
              Bool:
                'aws:SecureTransport':
                  - 'false'

Error message:

Invalid policy syntax. (Service: Amazon S3; Status Code: 400; Error Code: MalformedPolicy; Request ID: 91BF8921047D9D3B; S3 Extended Request ID: ZOVOzmFZYN6yB1btOqMqgJjOpzfiUpP86c2XiVylzYkg37fGga8/eYDL7C4WzwhmcDGU7NJkL68=)

Not sure where I got this wrong. Can I provision S3 bucket access to cross-account IAM? From the console permissions section, I was able to do it.

Answer 1

Your bucket is called cross-acct-permission-demo but your policy specifies cross-acct-perm-demo . Also your indentation is not correct for the first Action (though it should not cause this issue). Also not sure if the service-role principle is correct in this context.

Answer 2

If you want IAM users in account A to be able to access resources in account B then you create an IAM role in account B that gives access to the relevant resources in account B, then you define account A as a trusted entity for the IAM role, then you permit access to that role to the relevant users in account A. Those users in account A can now assume the (cross-account) role in account B, and gain access to resources in account B.

See Tutorial: Delegate Access Across AWS Accounts Using IAM Roles