AWS S3 object encryption and share

Hello.

The following documents may be helpful.
https://repost.aws/knowledge-center/cross-account-access-s3

Sharing can be done by setting a bucket policy in S3 that allows the IAM user or IAM role of the AWS account you wish to share to the bucket policy.

Other replication from S3 to S3 is also possible.
https://docs.aws.amazon.com/AmazonS3/latest/userguide/replication-walkthrough-2.html

If the S3 is encrypted with KMS CMK, a key policy must be set so that the CMK can be used by the AWS account to which it is shared.
https://docs.aws.amazon.com/AmazonS3/latest/userguide/replication-config-for-kms-objects.html#replications

Apart from above, you may look into signed URLs to allow externals to temporarily download the file from s3: https://docs.aws.amazon.com/AmazonS3/latest/userguide/ShareObjectPreSignedURL.html