访问客户端的 AWS S3 存储桶

Question

We are asked to upload a file to client's S3 bucket; however, we do not have AWS account (nor we plan on getting one). What is the easiest way for the client to grant us access to their S3 bucket?

Answer 1

My recommendation would be for your client to create an IAM user for you that is used for the upload. Then, you will need to install the AWS cli . On your client's side there will be a user that the only permission they have is to write to their bucket. This can be done pretty simply and will look something like:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "s3:PutObject"
            ],
            "Resource": [
                "arn:aws:s3:::the-bucket-name/*",
                "arn:aws:s3:::the-bucket-name"
            ]
        }
    ]
}

I have not thoroughly tested the above permissions!

Then, on your side, after you install the AWS cli you need to have two files. They both live in the home directory of the user that runs your script. The first is $HOME/.aws/config . This has something like:

[default]
output=json
region=us-west-2

You will need to ask them what AWS region the bucket is in. Next is $HOME/.aws/credentials . This will contain something like:

[default]
aws_access_key_id=the-access-key
aws_secret_access_key=the-secret-key-they-give-you

They must give you the region, the access key, the secret key, and the bucket name. With all of this you can now run something like:

aws s3 cp local-file-name.ext s3://the-client-bucket/destination-file-name.ext

This will transfer the local file local-file-name.ext to the bucket the-client-bucket with the file name there of destination-file-name.ext . They may have a different path in the bucket.

To recap:

1. Client creates an IAM user that has very limited permission. Only API permission is needed, not console.
2. You install the AWS CLI
3. Client gives you the access key and secret key.
4. You configure the machine that does the transfers with the credentials
5. You can now push files to the bucket.
6. You do not need an AWS account to do this.