What is the difference between identity-based and resource-based policies? How do they combine when a role in account A reads an S3 bucket in account B?

An identity-based policy is attached to a user, group or role. It says what that principal can do. A principal is whoever makes the request.

A resource-based policy is attached to a resource. Examples are an S3 bucket policy, an SQS queue policy or a KMS key policy. It has a Principal element that says who can access the resource.

In one account, an allow in either kind of policy is usually enough, as long as no explicit deny applies. KMS is an exception. The key policy must allow access, either directly or by handing the decision to IAM.

Across accounts, both sides must agree:

• The role in account A needs an identity policy that allows s3:GetObject on the bucket in B.
• The bucket policy in B must allow that role's ARN as the principal.
• If either one is missing, AWS denies the request.

If the objects are encrypted with a customer managed KMS key, the key policy must also allow the role.