An AWS account—for example, Account A—can grant another AWS account, Account B, permission to access its resources such as buckets and objects. Account B can then delegate those permissions to users in its account. In this example scenario, a bucket owner grants cross-account permission to another account to perform a specific bucket operation

This article helps you navigate this minefield, with details not only of how the S3 permissions work but also of how you can implement some common real-world scenarios such as S3 bucket access from another AWS account.

• Account A administrator user attaches a bucket policy granting cross-account permissions to Account B to perform specific bucket operations. Note that the administrator user in Account B will automatically inherit the permissions.
• Account B administrator user attaches user policy to the user delegating the permissions it received from Account A
• The user in Account B then verifies permissions by accessing an object in the bucket owned by Account A.

First, we need to create an s3 Bucket steps are given below:

Step 1: Log on to your AWS Console

Step 2: go to the Search bar  ” S3 services

Step 3: Click on S3  Scalable Storage in the Cloud” and proceed further

Step 4: Create a new Bucket

In the general configuration category:

Step 5: Enter the bucket name  (cross-account bucket ) 

Step 6: Next, choose the  AWS region,  [Asia Pacific (Mumbai) ap-south-1].

ACLs disabled (Recommended)

Bucket owner enforced – Bucket and object ACLs are disabled, and you, as the bucket owner, automatically own and have full control over every object in the bucket. Access control for your bucket and the objects in it is based on policies such as AWS Identity and Access Management (IAM) user policies and S3 bucket policies Objects can be uploaded to your bucket only if they don t specify an ACL or if they use the bucket-owner-full-control canned ACL.

Block Public Access settings for this bucket

Public access is granted to buckets and objects through access control lists (ACLs), bucket policies, access point policies, or all. In order to ensure that public access to this bucket and its objects is blocked, turn on Block all public access. These settings apply only to this bucket and its access points. AWS recommends that you turn on Block all public access, but before applying any of these settings, ensure that your applications will work correctly without public access. If you require some level of public access to this bucket or objects within, you can customize the individual settings below to suit your specific storage use cases

Bucket Versioning

Versioning is a means of keeping multiple variants of an object in the same bucket. You can use versioning to preserve, retrieve, and restore every version of every object stored in your Amazon S3 bucket. With versioning, you can easily recover from both unintended user actions and application failures.

Disable

Create the same again as above but put /* on bucket ARN

Copy policy

Go to Policy generator

past policy

 {
   "Version": "2012-10-17",
   "Id": "Policy1683696444814",
   "Statement": [
     {
        "Sid": "Stmt1683696418840",
        "Effect": "Allow",
        "Principal": {
          "AWS": "arn:aws:iam::Account-B-id :root"
        },
        "Action": "s3:*",
        "Resource": "arn:aws:s3:::cruse-account-s3-buckee"
     },
     {
       "Sid": "Stmt1683696442588",
       "Effect": "Allow",
       "Principal": {
         "AWS": "arn:aws:iam::Account-B-id:root"
       },
       "Action": "s3:*",
       "Resource": "arn:aws:s3:::cruse-account-s3-buckee/*"
      }
    ]
  }

After that, we have to log in to Aws Account ( B ).

Step 1: Now open a new tab and open AWS Policy Generator
https://awspolicygen.s3.amazonaws.com/policygen.

1: Select the Type of Policy  = IAM policy 

2: Actions = GetObject , ListBucket , PutObject

3: Amazon Resource Name (ARN) = arn:aws:s3:::cruse-account-s3-buckee

4: Click [ Add statement ]

5: Select the Type of Policy  = IAM policy 

6: Actions = GetObject , ListBucket , PutObject

7: Amazon Resource Name (ARN) = arn:aws:s3:::cruse-account-s3-buckee/*

Copy policy,

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Stmt1683701367955",
      "Action": [
        "s3:GetObject",
        "s3:ListBucket",
        "s3:PutObject"
      ],
      "Effect": "Allow",
      "Resource": "arn:aws:s3:::cruse-account-s3-buckee"
    },
    {
      "Sid": "Stmt1683701399477",
      "Action": [
        "s3:GetObject",
        "s3:ListBucket",
        "s3:PutObject"
      ],
      "Effect": "Allow",
      "Resource": "arn:aws:s3:::cruse-account-s3-buckee"
    }
  ]
}

Step 2: Navigate to the IAM Dashboard by clicking on the “Services” dropdown menu, selecting “SecuritNy, Identity, & Compliance,” and then clicking on “IAM.”

Step 2: Click on “Policies” in the left-hand menu and then click on the “Create policy” button.

Step 3: After generating paste it into Identity and Access Management (IAM) | Click on
Policy | Click on Create Policy | Click on JSON | Click on Create Policy

Click next

Step 4: file policy name = cruse-account-policy

Click Create policy

Security credentials

C:\> msiexec.exe /i https://awscli.amazonaws.com/AWSCLIV2.msi

C:\> msiexec.exe /i https://awscli.amazonaws.com/AWSCLIV2.msi /qn

C:\> aws --version
aws-cli/2.10.0 Python/3.11.2 Windows/10 exe/AMD64 prompt/off

command  = aws configure

  Access key ID

Secret access key

Inter

Inter

command  aws s3 ls s3://cruse-account-s3-buckee

 aws s3 cp "s3://cruse-account-s3-buckee/ aws bsnner.jpg" .