Account A's application (running as an IAM role) must read objects in Account B's S3 bucket. What's the complete permission requirement for a cross-account role assumption pattern?
A.Only the bucket policy in B allowing A's role
Resource policy alone can't grant what the caller's identity policy doesn't allow (except for same-account nuances — not cross-account).
B.Only an IAM policy in A allowing s3:GetObject
Identity policy alone can't grant access to another account's resource.
C.Both: identity policy granting access AND the bucket/resource policy in B trusting the role (or a cross-account role B that A assumes)
Correct. Both sides must allow it for cross-account access.
D.Make the bucket public temporarily
Public access is a breach, not a cross-account pattern.
Why this answer
Cross-account access requires BOTH sides: the identity policy in the calling account permits the action, and the resource policy in the owning account allows the external principal — either via a role in B that A's principal assumes, or a bucket policy trusting A's role directly.
Correct answer: C · Last reviewed 2026-10-26
Official AWS references
Practice this interactively
Answer without seeing the solution first in the IAM Deep Dive practice session.
Practice IAM Deep Dive