How to sync data between two s3 buckets owned by different profiles

Question

I want to sync data between two s3 buckets.

The problem is that each one is owned by different AWS accounts (i.e. access key id and secret access key).

I tried to make the destination bucket publicly writable, but I still get

fatal error: An error occurred (AccessDenied) when calling the ListObjects operation: Access Denied

How to solve this?

Enable cross account access in one of the IAM role (let's say account A). In the second account's (let's say account B) bucket, set the bucket policy to enable the account A's IAM role to write (s3:PutObject) to it. — krishna_mee2004
S3 buckets are owned by the root AWS account, not a specific IAM user/role/profile. Also, an S3 bucket doesn't specifically have access keys/secret keys, those are access credentials assigned to either the root AWS account or an IAM account. So are you saying that the buckets are owned by different AWS accounts? Or are you just saying that you currently use different IAM users under a single AWS account to access the buckets? — Mark B
Yes @MarkB. You're right, two buckets owned by different AWS accounts. Btw, I solved giving permissions to the source bucket account. — gc5

gc5 gc5 · Accepted Answer · 2017-10-04T16:53:12

I solved by giving permissions to write the destination bucket to the source bucket's AWS account.

I went to bucket "Permissions" tab of the destination bucket, "Access for other AWS accounts" and I gave permissions to the source bucket's AWS account by using the account email.

Then I copied the files by using AWS CLI (don't forget to grant full access to the recipient account!):

aws s3 cp s3://<source_bucket>/<folder_path>/ s3://<destination_bucket> --recursive --profile <source_AWSaccount_profile> --grants full=emailaddress=<destination_account_emailaddress>

How to sync data between two s3 buckets owned by different profiles

1 Answers