AWS Redshift cross account access

Question

Different teams own different datasets. The goal I want to accomplish is to be able to query different sources owned by different teams (AWS accounts).

• Account A - Redshift
• Account B - S3
• Account C - My account

From my account I would like to:

1. Access data from Account B's S3 bucket using redshift spectrum

2. Access Account A's redshift DB.

I know how to do do part 1, how can I query cross account redshift (part 2)?

Answer 1

The owner of the relevant Amazon S3 buckets in Account B should add a Bucket Policy that grants access to the IAM Role being used by Amazon Redshift.

From IAM Policies for Amazon Redshift Spectrum - Amazon Redshift:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Example permissions",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::redshift-account:role/spectrumrole"
            },
            "Action": [
                "s3:GetBucketLocation",
                "s3:GetObject",
                "s3:ListMultipartUploadParts",
                "s3:ListBucket",
                "s3:ListBucketMultipartUploads"
            ],
            "Resource": [
                "arn:aws:s3:::bucketname",
                "arn:aws:s3:::bucketname/*"
            ]
        }
    ]
}