A company wants an IAM role in Account A to be able to read objects from an S3 bucket owned by Account B, without the security team in Account B creating any duplicate IAM user or role. Which approach achieves this directly?
- Attach an identity-based policy to the Account A role granting s3:GetObject on the bucket's ARN, since that alone is sufficient for cross-account resource access
- Ask Account B to create an IAM user with the same name as the Account A role
- Enable S3 Transfer Acceleration on the bucket so cross-account requests bypass IAM checks
- Attach a bucket policy (a resource-based policy) on the Account B bucket that names the Account A role's ARN as an allowed principal
Why D? And why not the others?
Correct answer: D. Attach a bucket policy (a resource-based policy) on the Account B bucket that names the Account A role's ARN as an allowed principal
A resource-based policy, such as an S3 bucket policy, is attached directly to the resource itself and can name a principal from an entirely different AWS account, granting that principal access without the resource owner needing to create any matching IAM identity in their own account. This is the defining feature that separates resource-based policies from identity-based ones. The option describing an identity-based policy attached only in the requesting account is wrong because a policy on the requesting principal alone cannot grant it access to a resource it does not own; the resource owner's account must independently authorize the principal, and a bucket policy is the standard way to do that. The option about creating a matching IAM user in the resource owner's account is wrong and does not reflect how cross-account authorization works; it also does nothing to identify the actual calling principal from Account A. The option involving Transfer Acceleration is wrong because that feature only changes the network path used for faster uploads and downloads to S3; it has no effect on identity or access authorization.
Source: AWS IAM documentation: Identity-based policies and resource-based policies