AWS S3 cross account policy

Question

I would like to set a policy for a S3 bucket that is restricted to a VPC-ID(using a S3 endpoint). I have two accounts, A and B. I want a IAM user in A to access a bucket in B.

https://docs.aws.amazon.com/AmazonS3/latest/userguide/example-bucket-policies-vpc-endpoint.html

 { "Version": "2012-10-17", "Id": "Policy1415115909153", "Statement": [ { "Sid": "Access-to-specific-VPC-only", "Principal": "*", "Action": "s3:*", "Effect": "Deny", "Resource": ["arn:aws:s3:::awsexamplebucket1", "arn:aws:s3:::awsexamplebucket1/*"], "Condition": { "StringNotEquals": { "aws:SourceVpc": "vpc-111bbb22" } } } ] }

Above won't work, but following will:

{
"Version": "2012-10-17",
"Statement": [
    {
        "Effect": "Allow",
        "Principal": "*",
        "Action": "s3:*",
        "Resource": [
            "arn:aws:s3:::bucket",
            "arn:aws:s3:::bucket/*"
        ],
        "Condition": {
            "StringEquals": {
                "aws:SourceVpc": "vpc-111111111111"
            }
        }
    }
]

}

Feels like best practices is to use a deny policy. Anyone has an idea why and how solve it?

Answer 1

As pointed out you need to allow as-well. Combine both policies and it will work.