将文件从一个帐户中的 AWS S3 存储桶复制到 terraform/python 中另一个帐户中的存储桶

Question

Say if I have some data stored in account A, i want to be able to use some of them in account B (mainly for SageMaker usage), I guess I can copy files from bucket in account A to a bucket in account B, i did find some solutions by using aws cli, but is there a terraform / python solution to achieve this?

Is there an easy way to make one s3 bucket in account A to be accessible from account B? & what's the implementation look like in terraform/python (eg: boto3)?

Answer 1

In terraform you can do something like this:

terraform apply \
    -var="prod_access_key=AAAAAAAAAAAAAAAAAAA" \
    -var="prod_secret_key=SuperSecretKeyForAccountA" \
    -var="test_account_id=123456789012" \
    -var="test_access_key=BBBBBBBBBBBBBBBBBBB" \
    -var="test_secret_key=SuperSecretKeyForAccountB" \
    -var="bucket_name=tf-bucket-in-prod" \

Im not sure where you plan to run python from, but to answer your question you need to permit the IAM Role in Account A to assume an IAM Role in account B. As S3 also allows resource based policies you can create a bucket which includes a resource policy permitting another account:

https://docs.aws.amazon.com/AmazonS3/latest/userguide/example-walkthroughs-managing-access-example2.html