title: S3 bucket policy, how to ALLOW a IAM group from another account?
body: <p>I have one S3 bucket in one AWS account (say <code>arn:aws:s3:::my-test-bucket</code>), that needs to be accessed by a IAM group that is defined in another AWS account (say <code>arn:aws:iam::1111222333444:group/mygroup</code>). The following access policy refuses to save, and tells that <code>arn:aws:s3:::my-test-bucket</code> is an <em>invalid principal</em>.</p>
  
  <pre><code>{
      "Statement": [
          {
              "Action": [
                  "s3:ListBucket",
                  "s3:PutObject",
                  "s3:List*",
                  "s3:Get*"
              ],
              "Effect": "Allow",
              "Principal": {
                  "AWS": "arn:aws:iam::1111222333444:group/mygroup"
              },
              "Resource": [
                  "arn:aws:s3:::my-test-bucket",
                  "arn:aws:s3:::my-test-bucket/*"
              ],
              "Sid": "allow-put-for-dedicated-group"
          }
      ],
  }
  </code></pre>
  
  <p>I have tested by replacing the group with one of the users of the other account and this works:</p>
  
  <pre><code>{
      "Statement": [
          {
              "Action": [
                  "s3:ListBucket",
                  "s3:PutObject",
                  "s3:List*",
                  "s3:Get*"
              ],
              "Effect": "Allow",
              "Principal": {
                  "AWS": "arn:aws:iam::1111222333444:user/me"
              },
              "Resource": [
                  "arn:aws:s3:::my-test-bucket",
                  "arn:aws:s3:::my-test-bucket/*"
              ],
              "Sid": "allow-put-for-dedicated-user"
          }
      ],
  }
  </code></pre>
  
  <p>The group is existing, I do not understand why it says it is an invalid principal. In fact it does not accept any group of my other account.</p>
  
  <p>Does anyone have an explanation (and possibly a solution) to this behaviour?</p>
  
  <p>Thanks in advance,
  Cheers</p>