All Tools View Categories About Contact Privacy

Cross-Account Access Policy Generator

Build the identity-side IAM policy for accessing a resource in another AWS account.

Runs entirely in your browser — nothing you enter is uploaded.
This builds only one side of cross-account access. The identity policy generated here goes on your user/role in your own account. The other account's admin must separately attach a resource-based policy (or role trust policy) trusting your account — use the S3 Bucket Policy Generator / Resource-Based Policy Generator for that half. Without both, the request is denied.
0
statements
0
actions
-
structurally valid

  

About Cross-Account Access Policy Generator

Cross-account access in AWS is one of the most commonly misunderstood permission models, because it is never granted by a single policy — it always requires two, on two different sides of an account boundary, and forgetting one half is the single most common cause of a confusing "Access Denied" when both sides look correct in isolation. Cross-Account Access Policy Generator builds exactly one of those two halves: the identity-based policy attached to a user or role in your own account, stating which actions that identity is allowed to attempt against a resource that lives in a different AWS account.

The shape of this statement is intentionally simple: a single Allow effect, an Action list built from whatever you type into the actions textarea (one action per line, such as s3:GetObject or sts:AssumeRole), and a Resource field set to the target ARN you provide — an ARN in another account, identifiable by the account ID segment embedded in the ARN itself. A target-account-ID field is offered purely as an on-page label, so you and anyone reviewing the policy can see at a glance which external account this statement reaches for; it plays no role in the generated JSON, since the ARN itself already carries that information. An optional Sid gives the statement a human-readable name.

What this tool does not do, and says so plainly rather than leaving it implied, is grant the access by itself. AWS evaluates a cross-account request against permissions on both sides of the boundary: your identity policy (built here) must allow the call, and the resource owner in the other account must separately grant it — either through a resource-based policy attached directly to the resource (an S3 bucket policy, an SQS queue policy, a KMS key policy) or, when the target is a role you are assuming rather than a resource you are reading or writing directly, through that role's trust policy naming your account or a specific principal in it as trusted. Build only the identity-policy half here and stop, and the request will fail with an access-denied error that gives no hint the identity policy was actually correct — the missing half was on the other account's side. This tool exists specifically to build the identity-policy half correctly and to make that two-sided requirement explicit, rather than implying that one form and one JSON blob is the whole story.

Because the two halves are built by different people, often in different organizations, and sometimes months apart, keeping them conceptually separate — rather than trying to guess and merge both into one document — is deliberate. This tool's output is a complete, valid, standalone identity-based policy document you can attach to a role or user right away; pairing it with the correct resource-side statement (built with the S3 Bucket Policy Generator or the general Resource-Based Policy Generator elsewhere in this category, or a trust policy from the IAM Trust Policy Generator when the target is a role) is a separate step that has to happen on the other account's side.

Structural validation runs on the assembled document before it is shown — confirming Version, a recognized Effect, a non-empty Action, and a Resource are all present — and the resulting JSON is available to copy or download. Everything, including the account ID label, resource ARN, and action list, is processed entirely in your browser.

Features

  • Builds the identity-side (your account) half of a cross-account access grant.
  • Explicit, on-page explanation that a resource-side policy or trust policy is also required, with pointers to the tools that build it.
  • Target account ID field as a clear on-page label (not embedded in the output, since the ARN itself carries it).
  • Multi-line actions textarea — one action per line, collapsing to a string or array automatically.
  • Optional Sid for a human-readable statement name.
  • Structural validation of the assembled document.
  • Pretty-printed JSON output with Copy and Download .json.
  • Sample cross-account S3 read scenario pre-filled.
  • One-click clear.
  • 100% client-side — nothing is uploaded.

How to Use

  1. Enter the target account ID as a label, so you (and reviewers) know which account this statement reaches.
  2. Enter the service the target resource belongs to, for your own reference.
  3. Enter the target resource ARN in the other account.
  4. List the actions your identity should be allowed to perform, one per line.
  5. Optionally set a Sid.
  6. Click Build identity policy and review the structural validation result.
  7. Copy or download the JSON and attach it to your user or role.
  8. Separately, have the other account's administrator attach the matching resource-based policy or trust policy — this tool does not build that half.

Examples

Example 1 — cross-account S3 read. Target account 222222222222, service S3, resource ARN arn:aws:s3:::partner-bucket/*, actions s3:GetObject and s3:ListBucket — produces an identity policy your role can use, provided the partner also attaches a bucket policy trusting your account.

Example 2 — assuming a role in another account. Target account 333333333333, service STS, resource ARN arn:aws:iam::333333333333:role/PartnerAccessRole, action sts:AssumeRole — the role also needs a trust policy in the other account naming your account or role as a trusted principal.

Example 3 — cross-account SQS send. Resource ARN arn:aws:sqs:us-east-1:444444444444:partner-queue, action sqs:SendMessage — requires a matching SQS queue policy on the other side.

Example 4 — cross-account KMS decrypt. Resource ARN arn:aws:kms:us-east-1:555555555555:key/abcd-1234, action kms:Decrypt — KMS key policies are mandatory (not merely default-allow) for cross-account grants, so the other side's key policy step here is non-optional.

Example 5 — multiple actions. Actions listed as s3:GetObject, s3:PutObject, s3:ListBucket on separate lines produce an Action array with all three, rather than a bare string.

Benefits

  • Prevents the most common cross-account mistake — attaching only one of the two required policies — by explaining the other half explicitly instead of implying this tool is the whole solution.
  • Correctly formats single vs. multiple actions as a string or array.
  • Keeps the account ID visible as a label for review, without redundantly duplicating what the ARN already encodes.
  • Structural validation before you attach the policy.
  • Copy or download straight into the IAM console, CLI, or IaC.
  • Private — nothing entered ever leaves your browser.

Frequently Asked Questions

Does this tool grant cross-account access by itself?
No, and this is the single most important thing to understand about cross-account access: it always requires <strong>two</strong> separate policies, on two different sides, and this tool builds only one of them. This generator produces the <strong>identity-based policy</strong> — the permissions you attach to a user or role in your own AWS account, saying "this identity is allowed to call these actions against that ARN in the other account." The other account's administrator must separately attach a <strong>resource-based policy</strong> (or a role trust policy, if you are assuming a role) on their side naming your account or principal as a trusted principal. Without both halves in place, the request is denied.
Where do I build the other half — the resource-side policy?
Use a different, purpose-built tool: the S3 Bucket Policy Generator (for cross-account S3 access) or the general Resource-Based Policy Generator, both elsewhere in this AWS IAM ARN Tools category. Those build the <code>Principal</code>-bearing statement the other account's owner attaches to their resource, naming your account or role as trusted.
What if the target resource is an IAM role I need to assume, not something like an S3 bucket?
For assuming a role in another account, the "resource" is the role ARN and the action is typically <code>sts:AssumeRole</code>. This tool will happily build that identity-side statement, but the role in the other account also needs a trust policy naming your account or principal — see the IAM Trust Policy Generator for that side.
Why is the target account ID field just informational?
The generated statement does not need the other account's ID as JSON data — the target resource ARN you provide already embeds that account's ID (ARNs are of the form <code>arn:partition:service:region:account-id:resource</code>). The account ID field exists purely as a label/reminder on the page so you can see at a glance which account this statement is meant to reach; it is not written into the output JSON.
Can I restrict this further, e.g. by IP or MFA?
Not in this tool — it builds a plain Allow statement with actions and a resource. For conditions, build the statement here, then add a <code>Condition</code> block using the IP-Restricted Policy Generator, MFA-Required Policy Generator, or Time-Based Access Policy Generator in this category, and merge the condition into this statement by hand, or use the general IAM Policy Generator which supports full condition editing.
Does it validate that the ARN is correctly formatted for the service?
It checks that a resource ARN was entered and that the assembled document is structurally valid IAM JSON (Version, Effect, Action, Resource present). It does not parse or validate the ARN's service-specific segment format — use the ARN Validator tool in this category for that.
Can I list multiple actions?
Yes — enter one action per line in the actions textarea. A single action collapses to a plain string in the output; two or more become a JSON array, matching how AWS itself renders these fields.
Is anything I enter sent anywhere?
No. The account ID, ARN, and actions are only used to assemble JSON in your browser; nothing is uploaded.
What is the Sid field for?
An optional statement ID, purely a human-readable label inside the policy JSON — AWS does not require it and it has no effect on evaluation. Leave it blank and the field is simply omitted from the output.