You are developing a Lambda in your Dev1 account, the purpose of this Lambda is to save QR codes in two S3 buckets, one bucket (BucketDev1) is in the same account as the Lambda and the second bucket (BucketDev2) is in other AWS account called Dev2. A requirement is to only allow this specified Lambda from Dev1 to create objects in BucketDev2.
What do you need to grant access to this Lambda function for both S3 buckets?

Answer options:

A.Create a role called S3-Lambda with a policy that allows to create objects in any S3 bucket and attach it to the Lambda, create in BucketDev1 a bucket policy that only allows resources with the S3-Lambda role to write in BucketDev1.
B.Create a role called S3-Lambda with a policy that allows to create objects in any S3 bucket and attach it to the Lambda, create in BucketDev2 a bucket policy that allows resources with the S3-Lambda role from Dev1 account to write in BucketDev2.
C.Create a role called S3-Lambda with a policy that allows you to write in BucketDev1 and BucketDev2 and attach it to the Lambda. Create in BucketDev2 a bucket policy with two statements. The first statement denies all resources with the S3-Lambda role of Dev1 account to write in any S3 bucket, the second statement allows the specified Lambda from Dev1 account to write in the specified bucket in dev2 account.
D.Create two policies, the first one allows Lambda to create objects in BucketDev1 and the second, allows Lambda to create objects in BucketDev2. Create an IAM role with these two policies and attach it to the Lambda.

Correct Answer: B
Option A is incorrect because when you need to access a S3 bucket from an external account, you need to specify in the bucket policy an allowed statement with the ARN of the AWS Account as principal.
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "S3bucketLambda",
"Action": [
"s3:GetObject"
],
"Effect": "Allow",
"Resource": [
"arn:aws:s3:::YOURBUCKETHERE/*"
],
"Principal": {
"AWS": [
"arn:aws:iam::123456789012:role/LambdaRole123"
]
}
}
]
}
Option B is CORRECT because, you don`t need to write a bucket policy to access S3 bucket if the resource is in the same account and it has the permission to access the S3 bucket in the attached role or policy. With the bucket policy in the second account the Lambda from the first account can access BucketDev2. More details: https://aws.amazon.com/premiumsupport/knowledge-center/lambda-execution-role-s3-bucket/
Option C is incorrect because of the AWS IAM Logic and Hierarchy an explicit denial in any policy overrides any allowed statement. So with this approach in the end, the bucket has a denial for Lambda to access the bucket BucketDev2. More details: https://aws.amazon.com/premiumsupport/knowledge-center/iam-policy-tags-deny/
Option D is incorrect because if the S3 bucket is in a different account it will need a bucket policy to allow resources from other accounts to access it.