如何使用aws sdk v2将object复制到不同的亚马逊账户？

Question

I am working on java project in which I am using aws sdk v2 for using amazon s3 services. I am performing copy operation it is working with same account but not working with different account.

Code:-

     public void copyObjects(S3Object[] s3DestObjects, String sDestBucket, String sSourceBucket, String sSourceObject) {
        try {
    AwsBasicCredentials awsCreds = AwsBasicCredentials.create(
                    ACCESS_KEY,
                    SECRET_KEY);
            S3ClientBuilder s3ClientBuilder = 
        S3Client.builder().credentialsProvider(StaticCredentialsProvider.create(awsCreds));
            
                s3ClientBuilder.region(Region.US_EAST_2);
            
            S3Client s3Client = s3ClientBuilder.build();
            String encodedUrl = null;
            try {
                encodedUrl = URLEncoder.encode(sSourceBucket + "/" + sSourceObject, StandardCharsets.UTF_8.toString());
            } catch (UnsupportedEncodingException e) {
                System.out.println("URL could not be encoded: " + e.getMessage());
            }
            for (S3Object s3DestObject : s3DestObjects) {

                //CopyObjectRequest copyObjectRequest = CopyObjectRequest.builder().destinationBucket(dstBucket).destinationKey(dstS3Object.key).copySource(encodedUrl).build();
                CopyObjectRequest copyObjectRequest = CopyObjectRequest.builder()
                        .copySource(encodedUrl)
                        .destinationBucket(sDestBucket)
                        .destinationKey(s3DestObject.key)
                        .metadata(s3DestObject.getMetadata()).metadataDirective(MetadataDirective.REPLACE)
                        .build();
                CopyObjectResponse copyObjectResponse = s3Client.copyObject(copyObjectRequest);
            }
        } catch (S3Exception e) {
            throw e;
        }
    }

This above code is working with same account bucket but not working with different account bucket and getting error:-

 Access Denied (Service: S3, Status Code: 403, Request ID: 4VCND27Z6P3CEJ8H, Extended Request ID: 2T88jx4+R+LjO74pBHOhJj8uOUx6M4Hx3UYYkWm4Sbf6cb9NVM8f5DvFcanv0rbXhZUfEkqpSuI=)

please suggest how can i do copy objects to different accounts?

Answer 1

It appears your situation is:

• You have Amazon S3 buckets in different AWS Accounts
• You wish to copy objects between the buckets

There are two ways to do this:

1. 'Push' the objects

If your code is running in Account A and you wish to copy from a bucket in Account A to a bucket in Account B, then you will need:

• Permission on the IAM Entity (eg IAM User or IAM Role) that is being used by your program to write to the bucket in Account B, AND
• A bucket policy on the bucket in Account B that permits the IAM Entity used by your program to write to the bucket
• When copying the object, you must set ACL=bucket-owner-full-control to 'hand-over' ownership of the object to the destination AWS Account

OR

2. 'Pull' the objects

If your code is running in Account B and you wish to copy from a bucket in Account A to a bucket in Account B, then you will need:

• Permission on the IAM Entity (eg IAM User or IAM Role) that is being used by your program to read from the bucket in Account A, AND
• A bucket policy on the bucket in Account A that permits the IAM Entity used by your program to read from the bucket

Note that in both cases, your program needs permission from the AWS Account it is running in AND a bucket policy on the bucket in the other AWS Account.