Question

Is it possible to expose Amazon S3 account bucket (shared by ACL setings) to the users setup using new Amazon AIM API under different account?

I’m able to create working IAM policy when related to the users and objects belonging to a single account. But as it seems this no longer works when two different accounts are involved – despite account 2 being able to access account 1’s bucket directly.

Sample policy is:

{
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:*"
      ],
      "Resource": [
        "arn:aws:s3:::test1234.doom",
        "arn:aws:s3:::test.doom"
      ],
      "Condition": {}
    }
  ]
}

In this case AIM user is able to list test.doom bucket (owned by the same AWS account) and not ‘test1234.doom’ bucket (owned by the different AWS account). This is despite one account having correct ACL permissions to access the other bucket.

Answer 1

It looks like this can’t be done.

http://aws.amazon.com/iam/faqs/#Will_users_be_able_to_access_data_controlled_by_AWS_Accounts_other_than_the_account_under_which_they_are_defined

Although it looks like in the future they might be allowed to create data under another account.

http://aws.amazon.com/iam/faqs/#Will_users_be_able_to_create_data_under_AWS_Accounts_other_than_the_account_under_which_they_are_defined