hands-on lab

Cross-account access in AWS

Up to 2h
Get guided in a real environmentPractice with a step-by-step scenario in a real, provisioned environment.
Learn and validateUse validations to check your solutions every step of the way.
See resultsTrack your knowledge and monitor your progress.


Organizations opt to use multiple AWS accounts for a variety of reasons including:

  • Cost management
  • Constrain access to sensitive information
  • Reduce the impact of breaches
  • Logically grouping workloads by business units

Users and groups within one AWS account will often need to access resources in another AWS account. Instead of creating separate IAM users and groups in each account, access can be delegated to IAM users and groups in a different AWS account using cross-account IAM roles. Certain services also provide resource-based policies to allow access across accounts. This lab walks through the mechanics of configuring and using cross-account roles and resource-based policies, specifically S3 bucket policies. Policy evaluation logic is also discussed.

Learning objectives

Upon completion of this intermediate-level lab, you will be able to:

  • Understand how cross-account roles are configured
  • Assume different roles in the AWS Management Console
  • Assume different roles using the AWS CLI
  • Understand and configure Amazon S3 bucket policies in the context of cross-account access
  • Describe the policy evaluation logic flow in AWS

Intended audiences

  • AWS Security Engineers
  • Cloud practitioners
  • AWS Account Administrators


Familiarity with the following is recommended:

  • Basic IAM entities (users, user groups, policies, roles)
  • Basic Amazon S3 concepts (buckets, objects)

The following content can be used to fulfill the prerequisite:


May 9th, 2024 - Resolved an issue causing validation checks to fail

September 15th, 2023 - Resolved an issue causing the build account S3 bucket to not provision

Environment before

Environment after

About the author

Logan Rakai, opens in a new tab
Lead Content Developer - Labs
Learning paths

Logan has been involved in software development and research since 2007 and has been in the cloud since 2012. He is an AWS Certified DevOps Engineer - Professional, AWS Certified Solutions Architect - Professional, Microsoft Certified Azure Solutions Architect Expert, MCSE: Cloud Platform and Infrastructure, Google Cloud Certified Associate Cloud Engineer, Certified Kubernetes Security Specialist (CKS), Certified Kubernetes Administrator (CKA), Certified Kubernetes Application Developer (CKAD), and Certified OpenStack Administrator (COA). He earned his Ph.D. studying design automation and enjoys all things tech.

LinkedIn, Twitter, GitHub

Covered topics

Lab steps

Logging In to the Amazon Web Services Console
Explaining the cross-account scenario
Creating a cross-account role
Uploading the deployment assets via the console
Adjusting the cross-account role for the AWS CLI
Uploading the deployment assets via the AWS CLI
Controlling access with resource-based policies
Uploading the deployment asset using bucket policy access
Understanding S3 object ownership and ACLs
Uploading the deployment asset with bucket owner enforced