data "aws_iam_policy_document" "allow_access_from_another_account" {

  statement {
    actions = ["s3:GetObject", "s3:ListBucket"]

    principals {
      identifiers = ["123456789012"]
      type = "AWS"
    }
    resources = [aws_s3_bucket.example.arn, "${aws_s3_bucket.example.arn}/*"]
  }
}

resource "aws_s3_bucket" "example" {
  bucket = "my-tf-test-bucket"
}

resource "aws_s3_bucket_policy" "allow_access_from_another_account" {
  bucket = aws_s3_bucket.example.id
  policy = data.aws_iam_policy_document.allow_access_from_another_account.json
}