We have a set up with a trusting account and a trusted account with a cross account role created on the trusting account which the trusted account can assume.
The S3