I created service to managing files in S3.
Everything works fine on my account, but now I need to host whole service on my AWS but using S3 from other account.
While deploying app with sls deploy it returns message:
Received response status [FAILED] from custom resource. Message returned: Access Denied

Looks like problem causes processNewFile lambda function with event from S3.

Here is my serverless

service: ${env:SERVICE_NAME}

useDotenv: true
provider:
  name: aws
  runtime: nodejs20.x
  region: eu-west-1
  memorySize: 512
  versionFunctions: false
  iamRoleStatements:
    - Effect: "Allow"
      Action: S3:*
      Resource: "*"
    - Effect: "Allow"
      Action: 
        - "cognito-idp:AdminGetUser"
        - "cognito-idp:AdminListGroupsForUser"
      Resource: "*"

plugins:
  - serverless-plugin-typescript-express
  - serverless-plugin-typescript
  - serverless-dotenv-plugin

functions:
  processNewFile:
    handler: functions/processNewFile.handler
    timeout: 300
    events:
      - s3:
          bucket: ${env:S3_BUCKET}
          existing: true
          event:
            - s3:ObjectCreated:*

  file:
    handler: handler.handler
    events:
      - http:
          path: /file
          method: ANY
      - http:
          path: /file/{proxy+}
          method: ANY

  tag:
    handler: handler.handler
    events:
      - http:
          path: /tag
          method: ANY
      - http:
          path: /tag/{proxy+}
          method: ANY

  asset:
    handler: handler.handler
    events:
      - http:
          path: /asset
          method: ANY
      - http:
          path: /asset/{proxy+}
          method: ANY```


I tried methods from stakoverflow and also directly from AWS like