Manage Greengrass-V2 Components in central account
I'm currently trying to create a component in a tenant account using the artifact packaged in a central account S3 bucket. The tenant account and central account are in the same AWS Organization. I've tried the following settings to enable the tenant accounts to access the S3 bucket:
1. On the central account S3 bucket (I wasn't sure what Principal Service/User was trying to test this access, so I just "shotgunned" it):
```
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": [
"greengrass.amazonaws.com",
"iot.amazonaws.com",
"credentials.iot.amazonaws.com"
]
},
"Action": [
"s3:GetObject",
"s3:GetObjectVersion"
],
"Resource": "arn:aws:s3:::MY-CENTRAL-ACCOUNT-BUCKET/*"
},
{
"Effect": "Allow",
"Principal": {
"AWS": "*"
},
"Action": [
"s3:GetObject",
"s3:GetObjectVersion",
"s3:GetObjectTorrent",
"s3:GetObjectVersionAcl",
"s3:GetObjectAcl"
],
"Resource": "arn:aws:s3:::MY-CENTRAL-ACCOUNT-BUCKET/*",
"Condition": {
"StringEquals": {
"aws:PrincipalOrgID": "o-abc123def456"
}
}
},
...
]
}
```
2. On the `GreengrassV2TokenExchangeRole` in the tenant account, I've added the `AmazonS3FullAccess` AWS Managed policy (just to see if I could eliminate this Role as the blocker)
I've verified that, as a User in the tenant account, I have access to the object in S3 and can do `aws s3 cp` as a tenant User (so the bucket policy doesn't seem to be blocking things).
Whenever I try creating the Component in the tenant account, I'm met with:
```
Invalid Input: Encountered following errors in Artifacts: {s3://MY-CENTRAL-ACCOUNT-BUCKET/com.example.my-component-name/1.0.0-dev.0/application.zip = Specified artifact resource cannot be accessed}
```
... using either the AWS IoT Greengrass Console and the AWS CLI.
What am I missing? Is there a different service-linked role, I should be allowing in the S3 Bucket Resource Policy?
It just seems like an access-test during Component creation and not an actual attempt to access the resource. I'm fairly certain if I assumed the Greengrass-TES role, I'd be able to download the artifact too (although I haven't explicitly done that yet).
