跨账户访问特定 AWS 账户中的 S3 存储桶的 IAM 角色策略

Question

Allow access from IAM Role in AccountA to given S3 buckets only if they are present in AWS AccountB (using Account Number).

Here is my Role policy in AccountA which currently has following permission. How can I update it to only access S3 bucket in AccountB .

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "",
            "Effect": "Allow",
            "Action": [
                "s3:Get*",
                "s3:List*",
                "s3:Put*"
            ],
            "Resource": [
                "arn:aws:s3:::kul-my-bucket/my-dir/*"
            ]
        },
        {
            "Sid": "ListBucket",
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::kul-my-bucket"
            ]
        }
    ]
}

Wondering if it is possible or should I try it differently?

Is anything similar to this possible for my case by providing the condition in the policy:

"Condition": {
                "StringLike": {
                    "aws:accountId": [
                        "111111111111"
                    ]
                }
            }

I need this because on the S3 bucket in AccountB it allows root access to AccountA . Hence I want to put restriction on Role policy in AccountA .

Answer 1

I do not think it is possible to grant/deny access to an Amazon S3 bucket based on an AWS Account number. This is because Amazon S3 ARNs exclude the Account ID and instead use the unique bucket name.

You would need to grant Allow access specifically to each bucket by name.

I have seen this situation before where the requirement was to grant S3 permission to access buckets only in other accounts , but not the account owning the IAM User themselves. We could not determine a way to do this without also granting permission to access the "same account" S3 buckets.