FOUR WAYS TO GRANT CROSS-ACCOUNT ACCESS IN AWS

Summary from the TLDR InfoSec newsletter

Grant access to a specific IAM role using the Principal element of the resource-based policy, an AWS account using the Principal element, a particular IAM role in an account using the AWS:PrincipalArn condition, and an entire AWS organization using the AWS:PrincipalOrgId condition. This post includes an example scenario with an S3 bucket and discusses tradeoffs associated with each method.