A developer is configuring an application running on an Amazon EC2 instance in Account B () to read objects from an Amazon S3 bucket named `data-bucket` located in Account A (). The EC2 instance uses an IAM instance profile with an IAM role named `ReaderRole`.
The developer has attached the following IAM policy to `ReaderRole` in Account B:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"s3:GetObject"
],
"Resource": "arn:aws:s3:::data-bucket/*"
}
]
}
However, the application receives an AccessDenied error when attempting to download objects from `data-bucket`.
Which action should the developer take to resolve this error?
- AUpdate the trust policy of ReaderRole in Account B to allow the Amazon S3 service principal (s3.amazonaws.com) to assume the role.
- BEmbed the AWS access key and secret access key of an IAM user from Account A directly into the application's initialization code.
- Add a bucket policy to data-bucket in Account A that grants s3:GetObject permissions to the principal arn:aws:iam::444455556666:role/ReaderRole.Cevap
- DIn Account A, add a bucket policy to data-bucket that grants s3:GetObject permissions, specifying the EC2 Instance Profile ARN as the principal.
Cevap
Add a bucket policy to the S3 bucket in Account A that explicitly allows the IAM role from Account B to access the objects.
For cross-account S3 access, permissions must be granted in two locations: the identity-based IAM policy in the trusted account (Account B) must allow the action, and the resource-based S3 bucket policy in the trusting account (Account A) must trust the caller's identity. Because the identity-based policy is already correctly configured in Account B, adding the bucket policy in Account A that references the caller's IAM role ARN resolves the authorization gap.
Adım Adım Çözüm
Anahtar Kavram
Cross-Account IAM Resource Authorization