cross-account file upload in S3 bucket using boto3 and python

Question

I have an S3 bucket with a given access_key and secret_access_key . I use the following code to upload files into my S3 bucket successfully.

import boto3
import os

client = boto3.client('s3',
                        aws_access_key_id = access_key,
                        aws_secret_access_key = secret_access_key)

upload_file_bucket = 'my-bucket'
upload_file_key = 'my_folder/' + str(my_file)
client.upload_file(file, upload_file_bucket, upload_file_key)

Now, I want to upload my_file into another bucket that is owned by a new team. Therefore, I do not have access to access_key and secret_access_key . What is the best practice to do cross-account file upload using boto3 and Python?

Answer 1

You can actually use the same code, but the owner of the other AWS Account would need to add a Bucket Policy to the destination bucket that permits access from your IAM User. It would look something like this:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": [
        "s3:PutObject",
        "s3:PutObjectAcl"
      ],
      "Effect": "Allow",
      "Resource": "arn:aws:s3:::their-bucket/*",
      "Principal": {
        "AWS": [
          "arn:aws:iam::YOUR-ACCOUNT-ID:user/username"
        ]
      }
    }
  ]
}

When uploading objects to a bucket owned by another AWS Account I recommend adding ACL= bucket-owner-full-control , like this:

client.upload_file(file, upload_file_bucket, upload_file_key, ExtraArgs={'ACL':'bucket-owner-full-control'})

This grants ownership of the object to the bucket owner, rather than the account that did the upload.