Can't copy from from an S3 bucket in another account

Question

Added an update (an EDIT) at the bottom

Info

I have two AWS accounts. One with an S3 bucket and a second one that needs access to it.

On the account with the S3 bucket, the bucket policy looks like this:

 {
            "Sid": "DelegateS3ToSecAcc",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::Second-AWS-ACC-ID:root"
            },
            "Action": [
                "s3:List*",
                "s3:Get*"
            ],
            "Resource": [
                "arn:aws:s3:::BUCKET-NAME/*",
                "arn:aws:s3:::BUCKET-NAME"
            ]
},

In the second account, that tries to get the file from S3, I've attached the following IAM Policy (There are other policies too but this should give it access):

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:Get*",
                "s3:List*",
                "s3-object-lambda:Get*",
                "s3-object-lambda:List*"
            ],
            "Resource": "*"
        }
    ]
}

Problem

Despite everything, when I run the following command:

aws s3 cp s3://BUCKET-NAME/path/to/file/copied/from/URI.txt .

I get:

fatal error: An error occurred (403) when calling the HeadObject operation: Forbidden

Did I do something wrong? What did I miss? All my web the web results suggested making sure in the bucket policy I have /* and that the IAM policy allows S3 access but it's already there.

---

EDIT: aws s3 ls works on the file! It means it just relates to permissions somehow. It works from another AWS that may have uploaded the file. Just need to figure out how to open it up.

Answer 1

The aws s3 cp command does lots of weird stuff, including (it seems) calling head-object .

Try calling the pure S3 API instead:

aws s3api get-object --bucket BUCKET-NAME --key path/to/file/copied/from/URI.txt .