The short answer to this question is yes, it is possible to grant a cross account role access to your bucket while having S3 Block Public Access setting activated. Digressing a bit, S3 Block Public Access settings are used to provide control across an entire AWS Account or at the individual S3 bucket level to ensure that objects never have public access. Public access is granted to buckets and objects through access control lists (ACLs), bucket policies, or both.
Now a bucket policy is considered to be granting public access if it contains the Principal value as follows without any restricting conditions:
'*' here is used as a wildcard, to be interpreted as providing anonymous access or access to all.
If such a bucket policy is enabled on a bucket and if the S3 Block Public Access settings are 'on', then S3 Block Public Access settings override the S3 permissions that allow public access. (Specifying all object resources in the bucket policy by itself does not render a bucket public.) Therefore, you can provide access to a cross account role using a bucket policy similar to:
This policy provides read access to all objects in your S3 bucket only to the cross account role. In case you're looking to provide console access, you can also add "s3:ListBucket" permission (with the bucket as the resource) to list all objects in the bucket.
Hope this helps!
 S3 Block Public Access - https://aws.amazon.com/s3/features/block-public-access/
 Actions defined by Amazon S3 - https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazons3.html#amazons3-actions-as-permissions
[-] Bucket policy examples - https://docs.aws.amazon.com/AmazonS3/latest/userguide/example-bucket-policies.html
Apparently, I had to mention both bucket and bucket content in the policy...
"Resource": \[ "arn:aws:s3:::my-bucket-name", "arn:aws:s3:::my-bucket-name/*" ]
I tried to be VERY agressive with my permissions but still unable to read anything in the bucket...
I did not even setup the Block All Policy Access
And yet, if I try to browse
aws s3 --profile saml ls s3://my-bucket-here
I get this error message...
An error occurred (AccessDenied) when calling the ListObjectsV2 operation: Access Denied
It looks like I have opened all doors!!!
Edited by: EricGfK on Sep 9, 2021 5:52 PM
Unable to configure SageMaker execution Role with access to S3 bucket in another AWS accountasked 3 months ago
Can't download file from S3 bucket in another accountasked 2 years ago
Cross Account Copy S3 Objects From Account B to AWS KMS-encrypted bucket in Account Aasked 8 months ago
I need to transfer objects from s3 bucket to another s3 in the same accountasked 2 months ago
Cross account access from Athena to S3Accepted Answerasked 3 years ago
Grant Access to Control Tower created Cloudtrail S3 Bucketasked 8 months ago
Access bucket s3 from a role on another accountasked a year ago
What is the ideal way to copy objects from one S3 to another in a different region via boto3asked a month ago
grant access to one role in another account to all objects in an S3 bucket?asked a year ago
is it possible to transfer a lightsail instance to another account ?asked a year ago