title: Cross account access to a CodeArtifact repo
body: <p>I have an IAM user in account A with admin privileges and <code>arn:aws:iam::aws:policy/AWSCodeArtifactReadOnlyAccess</code> attached for good measure.</p>
  <p>The iam user from account A has an arn of <code>arn:aws:iam::***:user/test-user</code>.</p>
  <p>Account B has a CodeArtifact repo with an arn of <code>arn:aws:codeartifact:***:***:domain/test-repo</code>. This repo has a resource policy of</p>
  <pre class="lang-json prettyprint-override"><code>{
      &quot;Version&quot;: &quot;2012-10-17&quot;,
      &quot;Statement&quot;: [
          {
              &quot;Effect&quot;: &quot;Allow&quot;,
              &quot;Principal&quot;: {
                  &quot;AWS&quot;: &quot;arn:aws:iam::***:user/test-user&quot;
              },
              &quot;Action&quot;: &quot;codeartifact:*&quot;,
              &quot;Resource&quot;: &quot;*&quot;
          }
      ]
  }
  </code></pre>
  <p>When running AWS CLI commands, I'm using the access keys for the IAM user from account A. The following command works:</p>
  <pre><code>$ aws codeartifact get-repository-endpoint --domain test-repo --domain-owner *** --query repositoryEndpoint --output text --repository test --format pypi
  </code></pre>
  <p>Results in</p>
  <blockquote>
  <p><code>https://test-repo-***.d.codeartifact.***.amazonaws.com/pypi/test/</code></p>
  </blockquote>
  <p>This demonstrates that my resource policy is working (flipping the <code>Effect</code> to a <code>Deny</code> successful makes the above command fail).</p>
  <p>However, the following command</p>
  <pre><code>$ aws codeartifact get-authorization-token --domain test-repo --domain-owner *** --query authorizationToken --output text
  </code></pre>
  <p>fails with</p>
  <blockquote>
  <p>An error occurred (AccessDeniedException) when calling the GetAuthorizationToken operation: User: arn:aws:iam::<em><strong>:user/test-user is not authorized to perform: codeartifact:GetAuthorizationToken on resource: arn:aws:codeartifact:</strong></em>:***:domain/test-repo</p>
  </blockquote>
  <p>I believe I've followed the docs here:</p>
  <ul>
  <li><a href="https://docs.aws.amazon.com/codeartifact/latest/ug/repo-policies.html#granting-read-access-to-specific-principals" rel="noreferrer">https://docs.aws.amazon.com/codeartifact/latest/ug/repo-policies.html#granting-read-access-to-specific-principals</a></li>
  <li><a href="https://docs.aws.amazon.com/codeartifact/latest/ug/auth-and-access-control-iam-identity-based-access-control.html" rel="noreferrer">https://docs.aws.amazon.com/codeartifact/latest/ug/auth-and-access-control-iam-identity-based-access-control.html</a></li>
  </ul>
  <p>I would like to accomplish this with the specified principal and would like to not assume a role as it complicates my CI/CD pipeline</p>