copy file from one bucket to another in different account still set the s3 file owner to the source one

2
votes

I have a bucket in one account and I am trying to copy the content from this bucket to another bucket in another account:

Here I found: AWS S3 copy files and folders between two buckets

The following command:

aws s3 sync s3://mybucket-src s3://mybucket-target

does the trick. But the problem is when I copy an image in the destination bucket I see:

enter image description here

So as you can see the encryption is changed to access denied from none. So now when I even try to make the image public manually it does not work and I cannot even open the image.

Can anyone help what my problem is?

Here is my policy on target:

{ "Version": "2012-10-17", "Statement": [ { "Sid": "AllowAll", "Effect": "Allow", "Principal": { "AWS": [ "arn:aws:iam::xxxxxxxxxxxx:root", "" ] }, "Action": "", "Resource": [ "arn:aws:s3:::test", "arn:aws:s3:::test/*" ] } ] }

Also the default encryption is none on both buckets

Update: One more thing that might give a clue: I tested on another account with the same s3 set up and worked but those two accounts the same issue. I am not sure though what would be the issue since I am not even using encryption on s3. I think something is going on on account set up or maybe it is a bug in aws

Update:

One more thing I also noticed that the owner of the file copied in the new account is still the last account. So it is referencing to the last owner

1
amazon-web-servicesamazon-s3aws-sdk

1 Answers

2
votes

My answer assumes that you have the S3 objects encrypted using KMS Managed Keys (SSE-KMS).

You have two choices:

  1. Redo the copy decrypting the files before storing unencrypted in the destination bucket.
  2. Share encryption keys between accounts.

How to enable cross-account access to existing custom keys.

In the KMS console, click the custom key alias for which you want to enable cross-account access.

In the Key Usage section, look for the External Accounts subsection, and click Add External Account. Type the 12-digit AWS account ID of the account that you want to be able to use this key. Repeat this process for each additional external account you want to add. Click Save Changes when you are done.

Share Custom Encryption Keys