title: Boto3 not assuming IAM role from credentials where aws-cli does without problem
body: <p>I am setting up some file transfer scripts and am using boto3 to do this. </p>
  
  <p>I need to send some files from local to a third party AWS account (cross-account). I have a role set-up on the other account with permissions to write to the bucket, and assigned this role to a user on my account.</p>
  
  <p>I am able to do this no problem on CLI, but Boto keeps on kicking out an AccessDenied error for the bucket.</p>
  
  <p>I have read through the boto3 docs on this area such as they are <a href="https://boto3.amazonaws.com/v1/documentation/api/latest/guide/configuration.html#assume-role-provider" rel="nofollow noreferrer">here</a>, and have set-up the credential and config files as they are supposed to be (assume they are correct as the CLI approach works), but I am unable to get this working.</p>
  
  <p>Credential File:-</p>
  
  <pre><code>[myuser]
  aws_access_key_id = XXXXXXXXXXXXXXXXXXXXXX
  aws_secret_access_key = XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
  </code></pre>
  
  <p>Config File:-</p>
  
  <pre><code>[profile crossaccount]
  region = eu-west-2
  source_profile=myuser
  role_arn = arn:aws:iam::0123456789:role/crossaccountrole
  </code></pre>
  
  <p>and here is the code I am trying to get working with this:-</p>
  
  <pre class="lang-py prettyprint-override"><code>    #set-up variables
      bucket_name = 'otheraccountbucket'
      file_name = 'C:\\Users\\test\\testfile.csv'
      object_name = 'testfile.csv'
  
      #create a boto session with profile name for assume role call to be made with correct credentials
      session = boto3.Session(profile_name='crossaccount')
      #Create s3_client from that profile based session
      s3_client = session.client('s3')
  
      #try and upload the file
      response = s3_client.upload_file(
                      file_name, bucket, object_name,
                      ExtraArgs={'ACL': 'bucket-owner-full-control'}
                  )
  </code></pre>
  
  <p><strong>EDIT:</strong>
  in response to John's multi-part permission comment, I have tried to upload via put_object method to bypass this - but still getting AccessDenied, but now on the PutObject permission - which I have confirmed is in place:-</p>
  
  <pre class="lang-py prettyprint-override"><code>    #set-up variables
      bucket_name = 'otheraccountbucket'
      file_name = 'C:\\Users\\test\\testfile.csv'
      object_name = 'testfile.csv'
  
      #create a boto session with profile name for assume role call to be made with correct credentials
      session = boto3.Session(profile_name='crossaccount')
      #Create s3_client from that profile based session
      s3_client = session.client('s3')
  
      #try and upload the file
      with open(file_name, 'rb') as fd:
              response = s3_client.put_object(
                                  ACL='bucket-owner-full-control',
                                  Body=fd,
                                  Bucket=bucket,
                                  ContentType='text/csv',
                                  Key=object_name
                              )
  </code></pre>
  
  <p>Crossaccountrole has PutObject permissions - error is :-</p>
  
  <pre><code>An error occurred (AccessDenied) when calling the PutObject operation: Access Denied
  
  </code></pre>
  
  <p><strong>END EDIT</strong></p>
  
  <p>Here is the working aws-cli command:-</p>
  
  <pre><code>aws s3 cp "C:\Users\test\testfile.csv" s3://otheraccountbucket --profile crossaccount
  </code></pre>
  
  <p>I am expecting this to upload correctly as the equivalent  cli code does, but instead I get an S3UploadFailedError exception - An error occurred (AccessDenied) when calling the CreateMultipartUpload operation: Access Denied</p>
  
  <p>Any Help would be much appreciated</p>