Account A stores objects in an S3 bucket encrypted with a customer managed AWS KMS key in Account A. A data science role in Account B has been granted s3:GetObject on the bucket through the bucket policy, and its identity policy allows kms:Decrypt on the key's ARN. Requests from Account B still fail with an access denied error referring to the KMS key.