Why do I get the AmazonS3Exception "Access Denied with Status Code: 403" in Amazon Athena when I query a bucket in another account?

Short description

Access denied errors commonly occur when you query logs that were written by another AWS service, such as AWS CloudTrail or Amazon Virtual Private Cloud (Amazon VPC). These services log events to Amazon S3. The bucket owner has full access to the S3 objects. The second account doesn't own the bucket or the objects. When the second account queries an Athena table that references these S3 objects, you get an access denied error.

Resolution

It's not possible to transfer ownership of Amazon S3 objects. Instead, choose one of the following options:

• In the Athena account, assume an AWS Identity and Access Management (IAM) role that has access to both the bucket and the objects. For more information, see IAM tutorial: Delegate access across AWS accounts using IAM roles.
• Copy the objects to a bucket in the Athena account, and then delete redundant or unnecessary objects from the destination bucket to avoid unnecessary charges. To copy the objects, see How do I copy Amazon S3 objects from another AWS account?

Related information

Why can't I access an object that was uploaded to my Amazon S3 bucket by another AWS account?

How do I transfer the ownership of an Amazon S3 bucket to a different AWS account?

How do I resolve "Access Denied" permission errors when I run a query in Amazon Athena?