ACL permissions vary based on which S3 resource, bucket, or object that an ACL is applied to. For more information, see Access Control List (ACL) Overview. You can configure bucket and object ACLs when you create your bucket or when you upload an object to an existing bucket. For more information, see

Cross-account IAM roles

Because not all AWS services support resource-based policies, you can use cross-account IAM roles to centralize permission management when providing cross-account access to multiple services. Using cross-account IAM roles simplifies provisioning cross-account access to S3 objects that are stored in multiple S3 buckets while removing the need to manage multiple policies for S3 buckets. Using this method allows cross-account access to objects that are owned or uploaded by another AWS account or AWS services, such as AWS CloudTrail logs and Amazon CloudFront logs. If you don't use cross-account IAM roles, the object ACL must be modified. For more information, see

To use cross-account IAM roles to manage S3 bucket access, follow these steps:

1.    Create an IAM role in Account A and grant the role permissions to perform required S3 operations. In the role's trust policy, grant a role or user from Account B permissions to assume the role in Account A by using a policy similar to the following: