S3 Cross Account Notifications - amazon-s3

Question

It is possible to send S3 events from Account A to an SQS topic in Account B. But, the only way I have been able to achieve this is by opening the permissions for the sendMessage action in SQS to allow everyone access.
Is it possible to configure S3 events to sendMessage to a different account with some permission restrictions in place on the SQS topic?
For example, if I try to restrict access to a specific account (e.g. 123456789012, I receive an error in the S3 console when I try to save the event: "Unable to validate the following destination configurations : Permissions on the destination queue do not allow S3 to publish notifications from this bucket"
{
"Version": "2012-10-17",
"Id": "sqs-permission",
"Statement": [
{
"Sid": "sqs-permision-statement",
"Effect": "Allow",
"Principal": {
"AWS": "123456789012"
},
"Action": "SQS:SendMessage",
"Resource": "arn:aws:sqs:us-east-1:210987654321:my-queue"
}
]
}

Answer 1

According to the documented example, the authorization needs to be granted to S3, not the account owning the bucket.
"Principal": {
"AWS": "*"
},
...
"Condition": {
"ArnLike": {
"aws:SourceArn": "arn:aws:s3:*:*:bucket-name"
}
}
The * principal seems unusually permissive, but the likely explanation is that aws:SourceArn is not a value that could be spoofed by a malicious user, any more than, say, aws:SourceIp.
By contrast, the SNS example shows this principal, which seems more appropriate, if it works for SQS notifications:
"Principal": {
"Service": "s3.amazonaws.com"
},
You'd still want to include the Condition block.