title: How to Allow AWS Access from Batch Job to S3 on Another Account
body: <p>I have a batch job in account <code>A</code> and bucket in account <code>B</code>. When my job requests <code>s3:GetBucketLocation</code>, it returns <code>Access Denied</code>.</p>
  
  <p>I've set up such permissions on my batch job (account <code>A</code>):</p>
  
  <pre><code>{
      "Version": "2012-10-17",
      "Statement": [
          {
              "Effect": "Allow",
              "Action": [
                  "s3:GetObject",
                  "s3:ListBucket",
                  "s3:GetBucketLocation"
              ],
              "Resource": [
                  "arn:aws:s3:::bucket-in-account-B",
                  "arn:aws:s3:::bucket-in-account-B/*"
              ]
          }
      ]
  }
  </code></pre>
  
  <p>and bucket permissions (account <code>B</code>):</p>
  
  <pre><code>{
      "Version": "2012-10-17",
      "Statement": [
          ...,
          {
              "Sid": "123",
              "Effect": "Allow",
              "Principal": {
                  "AWS": "arn:aws:iam::{{numbers}}:role/{{name}}"
              },
              "Action": [
                  "s3:GetObject",
                  "s3:ListBucket",
                  "s3:GetBucketLocation"
              ],
              "Resource": [
                  "arn:aws:s3:::bucket-in-account-B",
                  "arn:aws:s3:::bucket-in-account-B/*"
              ]
          }
      ]
  }
  </code></pre>
  
  <p>These permissions don't work.</p>