title: S3 cross account access: Reading an object in own bucket, written by another account
body: <p><strong>Background:</strong></p>
  
  <p>I have two accounts <code>A</code> and <code>B</code>. Account <code>A</code> owns a bucket <code>my-bucket</code>. I have given account <code>B</code> access to this bucket -- account <code>B</code> can read objects from and write objects to this bucket. This is working as expected.</p>
  
  <p>However, account <code>A</code> can only read those objects in <code>my-bucket</code> that it has written on its own. Although it can list even those objects that account <code>B</code> has written, it cannot read those.</p>
  
  <p>Below is what I see when I try to download all objects from <code>my-bucket</code> using AWS CLI with AWS configuration of account <code>A</code>.</p>
  
  <pre><code>download: s3://my-bucket/PN1492646400000.csv to tp/PN1492646400000.csv
  download: s3://my-bucket/PN1491264000000.csv to tp/PN1491264000000.csv
  download: s3://my-bucket/PN1493942400000.csv to tp/PN1493942400000.csv
  download failed: s3://my-bucket/PN1503346865232.csv to tp/PN1503346865232.csv An error occurred (AccessDenied) when calling the GetObject operation: Access Denied
  download: s3://my-bucket/PN1495389670000.csv to tp/PN1495389670000.csv
  download: s3://my-bucket/PN1496685403000.csv to tp/PN1496685403000.csv
  download: s3://my-bucket/PN1497945130000.csv to tp/PN1497945130000.csv
  download: s3://my-bucket/PN1500508800000.csv to tp/PN1500508800000.csv
  </code></pre>
  
  <p>As one can see, I could download all files, but <code>PN1503346865232.csv</code> (this was written by account <code>B</code> using a java method <code>putObject</code>).</p>
  
  <p><strong>What I tried so far:</strong></p>
  
  <p>I have looked into the following two questions:</p>
  
  <ol>
  <li><a href="https://stackoverflow.com/questions/33236192/amazon-s3-file-access-denied-exception-in-cross-account?rq=1">Amazon S3 file &#39;Access Denied&#39; exception in Cross-Account</a>: One of the comment asks to do a putObject with <code>acl</code>, but does not specify what <code>acl</code>.</li>
  <li><a href="https://stackoverflow.com/questions/34055084/s3-user-cannot-access-object-in-his-own-s3-bucket-if-created-by-another-user?rq=1">S3: User cannot access object in his own s3 bucket if created by another user</a>: This talks about stopping account B from putting objects into <code>my-bucket</code> without giving ownership access. <em>Does just putting this constraint help me get full access?</em></li>
  </ol>
  
  <p>This is how I tried to put the ACL while putting the object in the java code.</p>
  
  <pre><code>AccessControlList acl = new AccessControlList();
  acl.grantPermission(new CanonicalGrantee(S3_BUCKET_OWNER_ID), Permission.FullControl);
  PutObjectRequest putObjectRequest = new PutObjectRequest(S3_BUCKET, remoteCleanedPrismFilename, fileStream, null)
                          .withAccessControlList(acl);
  s3Client.putObject(putObjectRequest);
  </code></pre>
  
  <p>It throws exception saying: <code>com.amazonaws.services.s3.model.AmazonS3Exception: Invalid id</code></p>
  
  <p><strong>Questions:</strong></p>
  
  <ol>
  <li><em>I wonder how am I supposed to get this ID. Is it not the aws account ID i.e. a 10-12 digit number?</em> </li>
  <li><em>Even if I find this ID, will giving this ACL same as <code>bucket-owner-full-
  control</code>?</em></li>
  </ol>