Search code examples
amazon-web-servicesamazon-s3amazon-iamaws-policies

S3 Bucket Policy to grant ListBucket permission to all users of a different AWS account

I have an Amazon S3 bucket in Account A.

I would like to grant ListBucket permission on this bucket to all users in Account B.

I tried to write an S3 Bucket Policy using a Principal of:

"Principal": {
    "AWS":"arn:aws:iam::<account_b>:user/*"
},

But I get an error:

Unknown Error
An unexpected error occurred.
API response
Invalid principal in policy

Is there a way that I can grant this permission?

Solution

  • When giving access to users in the other account, it's enough that you put just the account number as the principal:

    "Principal": {
    "AWS":"<account_b_number>"
},

    It is also required that users in account b have access to the bucket defined in their IAM policy.