Allowed on one side, denied on the other
The role has a policy allowing it to read the bucket. The read is denied. The policy is correct, it is attached, and it is spelled properly.
There are two policies in play and they attach to different objects: one to the identity doing the asking, one to the resource being asked for. The bucket lives in another account, and across that line both sides have to allow it. Only one does.
Boundaries, outermost first: Account A: Role (allowed to read), Identity policy (on the role) Account B: Bucket (no policy attached; FAILED: denied), an empty slot for the attached to the bucket Connections: Identity policy controls Role — allows the read Role calls attached to the bucket (step 1) attached to the bucket calls Bucket — both sides allow (step 2) Role must NOT reach Bucket — one allow is not enough