Can't download file from S3 bucket in another account

I'm using the aws:downloadContent Command Document plugin to download a file from an S3 bucket. It works fine when the S3 bucket is in the same account as the instance, but when the bucket is in a different account, the step fails with "Access Denied". The bucket is public, and I've given the instance full S3 permissions to access it. Is this a build-in restriction of SSM?