S3 Sharing Buckets Across Accounts

Question 1

How can I set up access control over an S3 bucket from the perspective of the bucket (that is, the rules are tied to the bucket)?

Answer 1

• Bucket Policies
• Bucket Access Control Lists (even less common)

Question 2

What is the difference between Bucket Policies and Bucket ACLs as it relates to sharing S3 buckets across accounts?

Answer 2

• Bucket Policies apply across the entire bucket
• Bucket ACLs apply to individual objects

Question 3

Which method of sharing S3 buckets across accounts is the only one that provides both Programatic and Console access?

Answer 3

Cross-account IAM Roles

Question 4

What are the 3 ways to share S3 buckets across accounts? What level of access does each provide?

Answer 4

• ​Bucket Policies & IAM – (applies across entire bucket) Programatic Access Only

​

• Bucket ACLs & IAM (applies to individual objects) Programatic Access Only
• Cross-account IAM Roles. – Programmatic AND Console Access