title: Allow cross-account access from an Amazon EC2 instance to an Amazon S3 bucket
body: <p>I have S3 bucket &quot;cross-bucket&quot; in Account say B.Now i want EC2 which is present in Account A to access this bucket &quot;cross-bucket&quot; in Account B.</p>
  <p>I need to achieve this using IAM roles as we are not allowed to create users.</p>
  <p>I have used below template to create role in Account B</p>
  <pre><code> AWSTemplateFormatVersion : '2010-09-09'
   Description: 'Cross account role for S3'
  
   Parameters:
     AccountId:
     Type: String
     Description: Account ID of admin account (containing user to allow)
  
   Resources:
   CrossAccountRole:
  Type: AWS::IAM::Role
  Properties:
    AssumeRolePolicyDocument:
      Statement:
        - Effect: Allow
          Action: sts:AssumeRole
          Principal:
            AWS:
              - !Sub arn:aws:iam::${AccountId}:root
    Path: /
    Policies:
      - PolicyName: my-s3-delegate
        PolicyDocument:
          Statement:
            - Effect: Allow
              Action:
                - s3:ListBucket
                - s3:GetObject
              Resource: &quot;*&quot;
    RootInstanceProfile: 
  Type: &quot;AWS::IAM::InstanceProfile&quot;
  Properties: 
    Path: &quot;/&quot;
    Roles: 
        - 
          Ref: &quot;CrossAccountRole&quot;
      
  </code></pre>
  <p>After creating this role how should i attach this to instance present in Account A?
  Or i am missing something here?</p>