Granting access to your bucket to another AWS account

Overview

Sometimes you may need to give another AWS account access to your Amazon S3 bucket. This allows users or applications in that account to work with the files in your bucket without sharing your account credentials.

There are two main ways to grant access to an Amazon S3 bucket:

Bucket policies define which AWS accounts can access the bucket and which actions they are allowed to perform.
Access Control Lists (ACLs) grant a set of permissions directly to another AWS account.

The following sections explain how to configure both methods in CS Browser.

Requirements

You need the 12-digit AWS Account ID of the account with which you want to share the bucket. The grantee can copy it from the Account page in the AWS Management Console.

To share your bucket via Bucket Policies

Start CS Browser and select the bucket you want to share.
Click Buckets > Edit Bucket Policy..
Open the Bucket Policy Editor from the Buckets menu.
The Bucket Policy Editor dialog will open:
Use the Bucket Policy Editor to view or edit the policy for the selected bucket.

Paste the following Bucket Policy to allow list bucket, upload and download files:

{
  "Id": "MyPolicy",
  "Statement": [
    {
      "Sid": "AllowBucketList",
      "Action": [
        "s3:ListBucket"
      ],
      "Effect": "Allow",
      "Resource": "arn:aws:s3:::s3browser",
      "Principal": {
        "AWS": [
          "1234-5678-9012"
        ]
      }
    },
    {
      "Sid": "AlowUploadDownload",
      "Action": [
        "s3:GetObject",
        "s3:PutObject"
      ],
      "Effect": "Allow",
      "Resource": "arn:aws:s3:::s3browser/*",
      "Principal": {
        "AWS": [
          "1234-5678-9012"
        ]
      }
    }
  ]
}

Replace s3browser with your actual bucket name and 1234-5678-9012 with the actual grantee's AWS Account ID.

If you would like to grant other permissions, please check AWS Policy Generator to create bucket policy you need.

Click Apply to save changes and close the dialog.
Please check out these instructions to learn how the grantee can connect to the bucket you shared with them.

Requirements

You can identify the grantee by the email address associated with their AWS account. Use the address they use to sign in to the AWS Management Console. If the same email address is associated with more than one AWS account, use the account Owner ID instead.

The Owner ID is not the same as the AWS Account ID. The grantee can copy the Owner value from the bucket Properties tab in CS Browser:

Copy the Amazon S3 account Owner ID from bucket properties — Copy the Owner value from the bucket Properties tab.

To share the bucket via Access Control List (ACL)

Select the bucket you want to share and click Buckets > Edit Permissions (ACL)..
Open the Permissions tab from the Buckets menu.
The Permissions tab will open:
Click More.. and choose Add user by Email/ID.
Click More.. > Add user by Email/ID.
The Add user by Email/ID dialog will open:
Enter or paste the grantee's account email address or Owner ID.
Enter or paste the grantee's account email address or Owner ID.
Check the permissions you want to grant and click Apply changes.
Select the required permissions and apply the changes.
Important note: if you plan to allow file upload (the Write permission) we recommend to grant the Read Permissions too AND uploader (the grantee) should also enable permissions inheritance in Tools > Options > General. This is important if you need access to the files uploaded by another account.
Please check out these instructions to learn how the grantee can connect to the bucket you shared with them.