How do bucket policies handle the Principal element for cross-account roles?

When handling cross-account roles, the Principal element in an S3 bucket policy specifies the Amazon Resource Name (ARN) of the IAM role in the external AWS account that is being granted access. This establishes a trust relationship, allowing the bucket in Account A to permit actions by a specific role in Account B.

Mechanics of Cross-Account Access

The Principal element uses the format "AWS": "arn:aws:iam::ACCOUNT-ID:role/ROLE-NAME". For instance, if a bucket in Account A needs to grant access to a role named CrossAccountRole in Account B (ID 123456789012), the bucket policy's Principal would be "AWS": "arn:aws:iam::123456789012:role/CrossAccountRole". This is a resource-based policy, directly granting permissions on the S3 bucket to an external IAM identity.

Crucially, for this cross-account access to function, the IAM role in Account B must also have a trust policy that permits sts:AssumeRole from the identity that will be using it (e.g., a user or service in Account B). This two-part permission model ensures that both the resource (S3 bucket) and the identity (IAM role) explicitly allow the interaction.

Example and Best Practices

Consider a scenario where Account A's bucket my-data-bucket needs to allow Account B's DataProcessorRole to read objects from a specific prefix.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::123456789012:role/DataProcessorRole"
      },
      "Action": [
        "s3:GetObject",
        "s3:ListBucket"
      ],
      "Resource": [
        "arn:aws:s3:::my-data-bucket/processed-data/*",
        "arn:aws:s3:::my-data-bucket"
      ],
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": "203.0.113.0/24"
        }
      }
    }
  ]
}

This example demonstrates applying the principle of least privilege by specifying only s3:GetObject and s3:ListBucket actions, limiting the Resource to a specific prefix, and adding a Condition for a source IP address. Additional conditions like aws:MultiFactorAuthPresent can further enhance security.

In the interview, also mention the importance of the sts:AssumeRole permission on the cross-account role's trust policy, as it's a common point of misconfiguration for cross-account access.