title: AWS Providing access to assumed role from another account to access S3 in my account
body: <p>What I am trying to achieve is to copy objects from S3 in one account (A1 - not controlled by me) into S3 in another account (A2 - controlled by me).
  For that OPS from A1 provided me a role I can assume, using boto3 library.</p>
  
  <pre><code>session = boto3.Session()
  sts_client = session.client('sts')
  
  assumed_role = sts_client.assume_role(
      RoleArn="arn:aws:iam::1234567890123:role/organization",
      RoleSessionName="blahblahblah"
  )
  </code></pre>
  
  <p>This part is ok.
  Problem is that direct copy from S3 to S3 is failing because that assumed role cannot access my S3.</p>
  
  <pre><code>s3 = boto3.resource('s3')
  copy_source = {
      'Bucket': a1_bucket_name,
      'Key': key_name
  }
  
  bucket = s3.Bucket(a2_bucket_name)
  bucket.copy(copy_source, hardcoded_key)
  </code></pre>
  
  <p>As a result of this I get</p>
  
  <pre><code>botocore.exceptions.ClientError: An error occurred (403) when calling the HeadObject operation: Forbidden
  </code></pre>
  
  <p>in this line of code:</p>
  
  <pre><code>bucket.copy(copy_source, hardcoded_key)
  </code></pre>
  
  <p>Is there any way I can grant access to my S3 for that assumed role?
  I would really like to have direct S3 to S3 copy without downloading file locally before uploading it again.</p>
  
  <p>Please advise if there is a better approach than this.</p>
  
  <p>Idea is to have this script running inside of a AWS Data Pipeline on daily basis for example.</p>