将数据从一个AWS账户中的S3存储桶复制到另一个AWS账户中的S3存储桶

Question

I'm trying to copy S3 bucket objects from one AWS to another AWS account. I have followed this link here it works with one account A but gives Access Denied error when i used it with another account B. What could be the possible reason for that? Is it related to some firewalls or security issues, even the source account B bucket has been made public. This is the policy applied to source bucket B

{

  "Version": "2012-10-17",

  "Statement": [

    {

      "Sid": "DelegateS3Access",

      "Effect": "Allow",

      "Principal": {

        "AWS": "arn:aws:iam::12345678910:user/abc"

      },

      "Action": [

        "s3:ListBucket",

        "s3:GetObject"

      ],

      "Resource": [

        "arn:aws:s3:::sourceBucketB/*",

        "arn:aws:s3:::sourceBucketB"

      ]

    }

  ]

}

This is policy applied to destination account

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket",
                "s3:GetObject"
            ],
            "Resource": [
                "arn:aws:s3:::sourcebucket",
                "arn:aws:s3:::sourcebucket/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket",
                "s3:PutObject",
                "s3:PutObjectAcl"
            ],
            "Resource": [
                "arn:aws:s3:::destinationbucket",
                "arn:aws:s3:::destinationbucket/*"
            ]
        }
    ] }

[here are the configurations of bucket from account B] [1\\

I'm using the following command to copy from bucket B to destination account (using destination account profile)

aws s3 sync s3://sourceBucket s3://destinationBucket

Here is the error

fatal error: An error occurred (AccessDenied) when calling the ListObjectsV2 operation: Access Denied

Answer 1

This documentation contains the exact policy you require and the necessary steps.

According to that documentation, the policy should look like this:

{
  "Version": "2012-10-17",
  "Statement": [
     {
        "Sid": "Example permissions",
        "Effect": "Allow",
        "Principal": {
           "AWS": "arn:aws:iam::AccountB-ID:root"
        },
        "Action": [
           "s3:GetBucketLocation",
           "s3:ListBucket"
        ],
        "Resource": [
           "arn:aws:s3:::sourcebucket"
        ]
     }
  ]
}

Answer 2

The easy way (grant all):

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": "s3:*",
      "Effect": "Allow",
      "Resource": "*",
      "Principal": "*"
    }
  ]
}

Also this seems unnecessary and could complicate things (in your second policy):

{
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket",
                "s3:GetObject"
            ],
            "Resource": [
                "arn:aws:s3:::sourcebucket",
                "arn:aws:s3:::sourcebucket/*"
            ]
        },