Problem
Saving a bucket policy fails with Invalid principal in policy. This is a policy-validation problem, distinct from a saved policy that later denies an object request.
Diagnose
Inspect the Principal element and verify the identity in its owning account:
aws iam get-role \
--role-name YOUR_ROLE_NAME \
--query 'Role.Arn' \
--output textUse credentials for the role's account. Compare the returned ARN, including any path, with the policy. An access-denied response to this diagnostic does not prove the role is missing.
Fix
Replace an incorrect ARN or stale deleted-principal reference with the intended existing role ARN. If the role was deleted and recreated, review the policy relationship again rather than assuming the old principal reference still works.
For cross-account access in an opt-in Region, verify the relevant Region is enabled where AWS requires it. Keep the allowed actions and resources scoped to the intended operation.
Do not replace the principal with a wildcard to make policy validation pass.
Verify
Save the corrected policy, then test the intended object operation using the intended role. Confirm an unrelated identity is still denied. Successful policy validation alone does not prove all required identity policies and resource policies permit the request.