I am stumped.

I have a credential for account A: `arn:aws:iam::<ACCOUNT>:user/<USER>`

I have a bucket in account B: `arn:aws:s3:::bucket-name`

Policy on the bucket in account B is set to:

```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "s3:*"
            ],
            "Effect": "Allow",
            "Principal": {"AWS": "arn:aws:iam::<ACCOUNT>:user/<USER>"},
            "Resource": [
                "arn:aws:s3:::bucket-name/*",
                "arn:aws:s3:::bucket-name"
            ]
        }
    ]
}

```

`aws --profile <PROFILE> s3 ls s3://bucket-name`

fails with:

`An error occurred (AccessDenied) when calling the ListObjects operation: Access Denied`

I have tried 1001 variations on the policy. What am I missing?