A company is developing an ML model for a customer.

For cross-account Amazon S3 access, AWS requires two components:

An S3 bucket policy in the owning account (Account A) that grants access to a principal in another account

An IAM role policy in the consuming account (Account B) that allows the service to access the bucket

Amazon SageMaker training jobs assume an IAM role in the account where the job runs—in this case, Account B. Therefore, the IAM policy must be attached to the SageMaker execution role in Account B.

The S3 bucket policy must reside in Account A because bucket policies are owned and enforced by the bucket owner. This policy explicitly allows the IAM role from Account B to read the training data.

Any other combination fails either because the policy is in the wrong account or because the role is not the one used by SageMaker.

AWS documentation clearly describes this pattern as the correct way to grant cross-account access for SageMaker training jobs.

Therefore, Option B is the correct and AWS-aligned solution.