IAM "account identifier" (":root" suffix) principal in S3 / KMS resource policy is not granting access

Question

My best understanding of the "arn:aws:iam::[account-id]:root" principal is that it refers to all IAM users and roles in that account. Although I have found some confusing explanations of it, this one from the IAM course in AWS Skill Builder had a clear description:

"When you use an AWS account identifier as the principal in a policy, you delegate authority to the account. Within that account, the permissions in the policy statement can be granted to all identities, including IAM users and roles in that account. "

So I wanted to put that to the test by creating the following S3 bucket policy:

```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Statement1",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::[my-account-id]:root"
            },
            "Action": [
                "s3:PutObject",
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::[bucket-name]/*",
                "arn:aws:s3:::[bucket-name]"
            ]
        }
    ]
}
```

My expectation was: any user (or assumed role) that is present in my account can list objects in this bucket without an explicit identity policy.
Reality: access denied.

Everything is happening in a single account (no cross-account activity)

My confusion is compounded by the fact that the S3 example bucket policies use this format as well (https://docs.aws.amazon.com/AmazonS3/latest/userguide/example-bucket-policies.html) and that the KMS default key policy (https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html#key-policy-default-allow-root-enable-iam) also uses the ":root" principal for encryption/decryption access but that it also refused me access.

How is this "account identifier" / "account principal" supposed to work? Am I completely misinterpreting the explanation I quoted above?

Answer

Your policy looks good to me.

Try to use the Policy Simulator (https://policysim.aws.amazon.com/home/index.jsp)

It can show you which policy is deying you access.

Answer

Hello.

Even if I grant permission to "arn:aws:iam::[my-account-id]:root" in the S3 bucket policy, IAM users are not allowed.  
When granting permission to an IAM user, you need to specify the IAM user's ARN like "arn:aws:iam::AWS-account-ID:user/user-name".  
"arn:aws:iam::[my-account-id]:root" allows access to "[my-account-id]", but if permission is not set in the IAM policy Unable to access S3.  
https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies-cross-account-resource-access.html#access_policies-cross-account-delegating-resource-based-policies

Please read this document.  
https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_principal.html#principal-accounts  
> When you allow access to a different account, an administrator in that account must then grant access to an identity (IAM user or role) in that account.

IAM "account identifier" (":root" suffix) principal in S3 / KMS resource policy is not granting access

Relevant content