Cross account S3 access with CannedACL

Question

We have a usecase where we put objects in an S3 bucket which is in different account than ours. We do that using IAM user. This is working fine.

We've now replaced IAM user based access with IAM role based access. Hence instead of IAM user I have created an IAM role and I have put identical permissions (same as IAM user) for IAM role at all places(on IAM role, on S3 bucket).

But it's giving 403 error when I try to put an object in that bucket. What could be the reason (Shall I whitelist the sts arn on bucket? Do we need to change bucket ACLs in anyway?)

The S3 bucket has following policy attached

IAM role in account A is: arn:aws:iam::AAAAAA:role/my-role

Bucket in account B is: arn:aws:s3:::bucket

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Allow Development Write Access",
            "Effect": "Allow",
            "Principal": {
                "AWS": [
                    "arn:aws:iam::AAAAAA:role/my-role"
                ]
            },
            "Action": "s3:Put*",
            "Resource": [
                "arn:aws:s3:::bucket/*",
                "arn:aws:s3:::bucket"
            ],
            "Condition": {
                "StringEquals": {
                    "s3:x-amz-acl": "bucket-owner-full-control"
                }
            }
        },
        {
            "Sid": "Allow Development Read Access",
            "Effect": "Allow",
            "Principal": {
                "AWS": [
                    "arn:aws:iam::AAAAAA:role/my-role"
                ]
            },
            "Action": [
                "s3:List*",
                "s3:Get*"
            ],
            "Resource": [
                "arn:aws:s3:::bucket/*",
                "arn:aws:s3:::bucket"
            ]
        }
    ]
}

I'm accessing it with the following piece of code:

s3Client.putObject(new PutObjectRequest(bucketName, key, file)
                            .withCannedAcl(CannedAccessControlList.BucketOwnerFullControl));

What could I be missing here?

Answer 1

This is fixed now. There was server side encryption enabled for that S3 bucket and my IAM role didn't have permission to KMS key used for encryption. Once this role given permission to KMS key it worked.

I didn't have to use that KMS key while making a putObject request, not sure why it required permission to KMS key then.

Also I could list the buckets (before the KMS key permission given) but couldn't put object (strange!)