S3 Access Grants cross-account access

With S3 Access Grants, you can grant Amazon S3 data access to the following:

First, configure cross-account access for the other account. This includes granting access to your S3 Access Grants instance by using a resource policy. Then, grant access to your S3 data (buckets, prefixes, or objects) by using grants.

After you configure cross-account access, the other account can request temporary access credentials to your Amazon S3 data from S3 Access Grants. The following image shows the user flow for cross-account S3 access through S3 Access Grants:

Configuring S3 Access Grants cross-account access

To grant cross-account S3 access through S3 Access Grants, follow these steps:

Step 1: Configure an S3 Access Grants instance in your account

First, you must have an S3 Access Grants instance in your account 111122223333 to manage access to your Amazon S3 data. You must create an S3 Access Grants instance in each AWS Region where the S3 data that you want to share is stored. If you are sharing data in more than one AWS Region, then repeat each of these configuration steps for each AWS Region. If you already have an S3 Access Grants instance in the AWS Region where your S3 data is stored, proceed to the next step. If you haven’t configured an S3 Access Grants instance, see Create an S3 Access Grants instance to complete this step.

Step 2: Configure the resource policy for your S3 Access Grants instance to grant cross-account access

After you create an S3 Access Grants instance in your account 111122223333 for cross-account access, configure the resource-based policy for the S3 Access Grants instance in your account 111122223333 to grant cross-account access. The S3 Access Grants instance itself supports resource-based policies. With the correct resource-based policy in place, you can grant access for AWS Identity and Access Management (IAM) users or roles from other AWS accounts to your S3 Access Grants instance. Cross-account access only grants these permissions (actions):

You can choose which of these permissions to include in the resource policy. This resource policy on the S3 Access Grants instance is a normal resource-based policy and supports everything that the IAM policy language supports. In the same policy, you can grant access to specific IAM identities in your account 111122223333, for example, by using the aws:PrincipalArn condition, but you don't have to do that with S3 Access Grants. Instead, within your S3 Access Grants instance, you can create grants for individual IAM identities from your account, as well as for the other account. By managing each access grant through S3 Access Grants, you can scale your permissions.

If you already use AWS Resource Access Manager (AWS RAM), you can use it to share your s3:AccessGrants resources with other accounts or within your organization. See Working with shared AWS resources for more information. If you don't use AWS RAM, you can also add the resource policy by using the S3 Access Grants API operations or the AWS Command Line Interface (AWS CLI).

{
"Version": "2012-10-17",
"Statement": [
{
	"Effect": "Allow", 
	"Principal": {
	"AWS": "444455556666"
}, 
	"Action": [
		"s3:ListAccessGrants",
		"s3:ListAccessGrantsLocations",
		"s3:GetDataAccess",
		"s3:GetAccessGrantsInstanceForPrefix"
	],
	"Resource": "arn:aws:s3:us-east-2:111122223333:access-grants/default"
} ]
}

	aws s3control put-access-grants-instance-resource-policy \
	--account-id 111122223333 \
	--policy file://resourcePolicy.json \
	--region us-east-2
	{
		"Policy": "{\n 
		  \"Version\": \"2012-10-17\",\n 
		  \"Statement\": [{\n  
			\"Effect\": \"Allow\",\n
			\"Principal\": {\n
			  \"AWS\": \"444455556666\"\n
			},\n  
			\"Action\": [\n
			  \"s3:ListAccessGrants\",\n
			  \"s3:ListAccessGrantsLocations\",\n
			  \"s3:GetDataAccess\",\n
			  \"s3:GetAccessGrantsInstanceForPrefix\"\n
			],\n
			\"Resource\": \"arn:aws:s3:us-east-2:111122223333:access-grants/default\"\n
		   }\n  
		  ]\n
		  }\n",
		"CreatedAt": "2023-06-16T00:07:47.473000+00:00"
	}

aws s3control get-access-grants-instance-resource-policy \
--account-id 111122223333 \
--region us-east-2

{
"Policy": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"AWS\":\"arn:aws:iam::111122223333:root\"},\"Action\":[\"s3:ListAccessGrants\",\"s3:ListAccessGrantsLocations\",\"s3:GetDataAccess\"],\"Resource\":\"arn:aws:s3:us-east-2:111122223333:access-grants/default\"}]}",
"CreatedAt": "2023-06-16T00:07:47.473000+00:00"
}

aws s3control delete-access-grants-instance-resource-policy \
--account-id 111122223333 \
--region us-east-2

// No response body

{
"Version": "2012-10-17",
"Statement": [
{
	"Effect": "Allow", 
	"Principal": {
	"AWS": "444455556666"
}, 
	"Action": [
		"s3:ListAccessGrants",
		"s3:ListAccessGrantsLocations",
		"s3:GetDataAccess",
		"s3:GetAccessGrantsInstanceForPrefix"
	],
	"Resource": "arn:aws:s3:us-east-2:111122223333:access-grants/default"
} ]
}

Step 3: Grant IAM identities in a second account permission to call the S3 Access Grants instance in your account

After the owner of the Amazon S3 data has configured the cross-account policy for the S3 Access Grants instance in account 111122223333, the owner of the second account 444455556666 must create an identity-based policy for its IAM users or roles, and the owner must give them access to the S3 Access Grants instance. In the identity-based policy, include one or more of the following actions, depending on what’s granted in the S3 Access Grants instance resource policy and the permissions you want to grant:

Following the AWS cross-account access pattern, the IAM users or roles in the second account 444455556666 must explicitly have one or more of these permissions. For example, grant the s3:GetDataAccess permission so that the IAM user or role can call the S3 Access Grants instance in account 111122223333 to request credentials.

To use this example command, replace the user input placeholders with your own information.

{
	"Version": "2012-10-17",
	"Statement": [
	{
		"Effect": "Allow", 
		"Action": [
			"s3:GetDataAccess",
		],
			"Resource": "arn:aws:s3:us-east-2:111122223333:access-grants/default"
		} 
	]
}

For information on editing IAM identity-based policy, see Editing IAM policies in the AWS Identity and Access Management guide.

Step 4: Create a grant in the S3 Access Grants instance of your account that gives the IAM identity in the second account access to some of your S3 data

For the final configuration step, you can create a grant in the S3 Access Grants instance in your account 111122223333 that gives access to the IAM identity in the second account 444455556666 to some of the S3 data in your account. You can do this by using the Amazon S3 Console, CLI, API, and SDKs. For more information, see Create grants.

In the grant, specify the AWS ARN of the IAM identity from the second account, and specify which location in your S3 data (a bucket, prefix, or object) that you are granting access to. This location must already be registered with your S3 Access Grants instance. For more information, see Register a location. You can optionally specify a subprefix. For example, if the location you are granting access to is a bucket, and you want to limit the access further to a specific object in that bucket, then pass the object key name in the S3SubPrefix field. Or if you want to limit access to the objects in the bucket with key names that start with a specific prefix, such as 2024-03-research-results/, then pass S3SubPrefix=2024-03-research-results/.

The following is an example CLI command for creating an access grant for an identity in the second account. See Create grants for more information. To use this example command, replace the user input placeholders with your own information.

aws s3control create-access-grant \
--account-id 111122223333 \
--access-grants-location-id default \
--access-grants-location-configuration S3SubPrefix=prefixA* \
--permission READ \
--grantee GranteeType=IAM,GranteeIdentifier=arn:aws:iam::444455556666:role/data-consumer-1

After configuring cross-account access, the user or role in the second account can do the following: