AWS S3 权限 - put-bucket-acl 错误

Question

I am trying to move an S3 bucket from one account (A) to another (B). I have succeeded with that operation and remove the bucket from account A. I am trying to move the new bucket from account B to another bucket on account B, but learning that beside the bucket itself I have no access to the files. After much fighting with s3 cli and its permissions I checked s3api commands and found out that the files (surprise surprise) still holds the old ownership. I am trying now to change it, but came to a stand still with the put-bucket-acl , the JSON file isn't working for s3api command. I tried running the command in debug , but didn't make too much out of it. Anybody knows what to do ? Maybe a better way to solve this issue ?

what I did so far: the command:

aws s3api put-bucket-acl --bucket my-bucket  --cli-input-json file://1.json

(Same with put-object-acl)

1.json file:

"Grantee": {
"DisplayName": "account_B",
"EmailAddress": "user@mail.com",
"ID": "111111hughalphnumericnumber22222",
"Type": "CanonicalUser",
"Permission": "FULL_CONTROL"
 }

The errors I get :

Unknown parameter in input: "Grantee", must be one of: ACL, AccessControlPolicy, Bucket, ContentMD5, GrantFullControl, GrantRead, GrantReadACP, GrantWrite, GrantWriteACP Unknown parameter in input: "Permission", must be one of: ACL, AccessControlPolicy, Bucket, ContentMD5, GrantFullControl, GrantRead, GrantReadACP, GrantWrite, GrantWriteACP

UPDATE: AssumeRole between the 2 accounts doesn't work in my case. cli (s3cmd,s3api) GUI (MCSTools,bucketexplorer), ACL using headers,body (Postman) did not help as well.. I'm connecting AWS support and hoping for the best. I'll update when I have a solution.

Answer 1

So, AWS support came to the rescue... I'm leaving this for others to see, so they won't have to waste 2 days like I did trying to figure what the hell went wrong...

aws s3api get-object-acl --bucket <bucket_on_B> --key <Key_on_B_Owned_by_A>  --profile IAM_User_A > A_to_B.json

apply the outcome of:

aws s3api get-bucket-acl --bucket <Bucket_on_B> --profile IAM_User_B

onto the json file that was created, and then run

aws s3api put-object-acl --bucket <Bucket_on_B> --key <Key_on_B_Owned_by_A> --access-control-policy file://A_to_B.json --profile IAM_User_A

Answer 2

Your JSON is wrong. According to the documentation for the put-bucket-acl option you can generate valid JSON template ('skeleton') using --generate-cli-skeleton . For example:

aws s3api put-bucket-acl --bucket BUCKETNAME --generate-cli-skeleton

And here is the output:

{
    "ACL": "", 
    "AccessControlPolicy": {
        "Grants": [
            {
                "Grantee": {
                    "DisplayName": "", 
                    "EmailAddress": "", 
                    "ID": "", 
                    "Type": "", 
                    "URI": ""
                }, 
                "Permission": ""
            }
        ], 
        "Owner": {
            "DisplayName": "", 
            "ID": ""
        }
    }, 
    "Bucket": "", 
    "ContentMD5": "", 
    "GrantFullControl": "", 
    "GrantRead": "", 
    "GrantReadACP": "", 
    "GrantWrite": "", 
    "GrantWriteACP": ""
}

Answer 3

For anyone who's still looking to do this - OP probably looked at the right aws doc but overlooked the right command. I'm just glad I got to right command because of this stackoverflow page :)

https://docs.aws.amazon.com/cli/latest/reference/s3api/put-bucket-acl.html

^^ The json syntax with example is present there and instead of --cli-input-json , use --access-control-policy

{
  "Grants": [
    {
      "Grantee": {
        "DisplayName": "string",
        "EmailAddress": "string",
        "ID": "string",
        "Type": "CanonicalUser"|"AmazonCustomerByEmail"|"Group",
        "URI": "string"
      },
      "Permission": "FULL_CONTROL"|"WRITE"|"WRITE_ACP"|"READ"|"READ_ACP"
    }
    ...
  ],
  "Owner": {
    "DisplayName": "string",
    "ID": "string"
  }
}

I had the policy as a json file and used this command it worked just fine.

aws s3api put-bucket-acl --bucket bucketname --access-control-policy file://yourJson.json

Also one more thing to note is that I wasn't able to add permissions along with existing ones, old acl was being overwritten. So any permission you want to add needs to be in json policy file along with existing policy. It will be easier when you use some command to describe all the ACLs first.

Answer 4

The syntax is the following (with example):

aws s3api put-bucket-acl --bucket bucket_name --access-control-policy file://grant.json

grant.json file:

{
    "Grants": [
            {
            "Grantee": {
                "ID": "CANONICAL_ID_TO_GRANT",
                "Type": "CanonicalUser"
            },
            "Permission": "WRITE"
            },
            {
            "Grantee": {
                "ID": "CANONICAL_ID_TO_GRANT",
                "Type": "CanonicalUser"
            },
            "Permission": "READ"
            }
        ],
        "Owner": {
            "DisplayName": "example_owner",
            "ID": "CANONICAL_ID_OWNER"
        }
}