How to grant cross account S3 bucket access

General Policy

IAM Role + assume role is always preferred over access keys (if third party is on Amazon and their app can assumerole).
Access keys have to be rotated for best security practices, and they are harder to control/contain.

Approach

• Assume you had access key on Account A.

• You want access to a bucket on Account B

• Assume Account B bucket=sample-logs, add the following into its Bucket Policy.
  

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Stmt1357935647218",
            "Effect": "Allow",
            "Principal": {
                "AWS": [
                    "arn:aws:iam::AccountA:root"
                ]
            },
            "Action": "s3:ListBucket",
            "Resource": "arn:aws:s3:::sample-logs"
        },
        {
            "Sid": "Stmt1357935647218",
            "Effect": "Allow",
            "Principal": {
                "AWS": [
                    "arn:aws:iam::AccountA:root"
                ]
            },
            "Action": [
                "s3:Get*",
                "s3:List*"
            ],
            "Resource": "arn:aws:s3:::sample-logs/*"
        }
    ]
}

• Then on Account A, update user IAM inline policy with the below.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "s3:List*",
                "s3:Get*"
            ],
            "Resource": [
                "arn:aws:s3:::sample-logs",
                "arn:aws:s3:::sample-logs/*"
            ],
            "Effect": "Allow"
        }
    ]
}

Setting up IAM Users, Roles and bucket policy

• If you need access keys, you need an IAM User + policy.

• If a third party can assume role, you just need the role with sts:AssumeRole allowed for that account. You also need to update the s3 bucket policy to allow access from that account.