Amazon S3 access for other AWS accounts - amazon-web-services

Question

I am trying to give access permission for S3 bucket in account to another account.
For the created bucket in permission tab there is an option of Access for other AWS accounts. Under that I am seeing an Add Account button. I clicked it and gave my other account from which I want to access this bucket.
However, I am getting an Invalid ID error.

Answer 1

If you wish to grant access to specific User in a different account, it's quite simple. (I don't think this method will work for giving access to a different Account.)
Let's say you have:
Account A with Bucket A that you own
Account B with User B to which you wish to grant access
Ask User B for the ARN associated with their IAM User. This can be seen in the IAM Management Console and it will look like:
arn:aws:iam::123456789012:user/fred
Then, add a Bucket Policy to Bucket A:
{
"Version": "2012-10-17",
"Id": "S3AccessPolicy",
"Statement": [
{
"Sid": "GiveFredAccess",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::123456789012:user/fred"
},
"Action": [
"s3:GetObject",
"s3:ListBucket"
],
"Resource": [
"arn:aws:s3:::bucket-a",
"arn:aws:s3:::bucket-a/*"
]
}
]
}
This will allow Fred to access the S3 bucket. This works for users in the same account AND for users in a different account.

Answer 2

For getting the canonical ID, one of the simplest ways is to use CLI and run
aws s3api list-buckets command.
You will get the ID in the output.
There are other ways also for getting the canonical ID and are clearly described in the aws docs: https://docs.aws.amazon.com/general/latest/gr/acct-identifiers.html
list-buckets aws docs: https://docs.aws.amazon.com/cli/latest/reference/s3api/list-buckets.html

Answer 3

You need the "canonical user id". You can find out about this here.
To view your canonical user ID as a root user (console)
Sign in as the root user using your AWS account email address and password.
... snip ...
In the top right of the console, choose your account name or number. Then choose My Security Credentials.
If necessary, in the dialog box, choose Continue to Security Credentials. You can choose the box next to Don’t show me this message again to stop the dialog box from appearing in the future.
Expand the Account Identifiers section to view your canonical user ID.
Note
If you do not see the Account Identifiers section, then you are not signed in as the root user. Return to Step 1 above. If you do not have access to the root user credentials, contact your AWS account administrator and ask them to retrieve the canonical user ID.