Accessing S3 Inventory from another AWS account

1
votes

I've setup S3 inventory report for a bucket, the data being analyzed is in bucket/data while the inventory report is generated and stored into bucket/meta/inventory/.

Now I want to access it from another AWS account, I have created the IAM role policy for cross-account access and I can copy/get files via the SDK or the AWS CLI only from the bucket/data/ prefix. If I try to get files created for the S3 inventory report, like the manifest.json file or any csv file from the inventory report with path bucket/meta/inventory/.../data/report.csv, I get:

403 Access Denied

or via CLI

An error occurred (AccessDenied) when calling the GetObject operation: Access Denied.

It is strange as I have policy that allows s3:ListBucket and s3:GetObject for the whole bucket for that IAM role but it seems that the files created by the s3.amazonaws.com service, in this case all files from the inventory report are not accessible for that IAM Role.

Does someone has encountered this? Anyone can suggest a fix?

1
amazon-web-servicesamazon-s3
can you add your policy to the question as well? Most common case when working with buckets is that for some actions you just need to add as resource the bucket path (bucket) while for other actions you need to specify the items (bucket/*) - Ay0
@yzT the issue is that the owner of the files generated by the inventory report is an external AWS account used to generate and save those files and I was missing bucket-owner-full-control acl in the policy. - B. Pesevski
FYI - this seems to be working when accessing objects from another account using an IAM policy. When relying on bucket policy to grant permissions (eg. accessing inventory files by Athena from another account) still forbids reading inventory objects. Rewriting object (to change owner) seems to be the only solution I found. - botchniaque

1 Answers

1
votes

I have found the issue, it seems that you must provide "s3:x-amz-acl": "bucket-owner-full-control" StringEquals Condition in the bucket policy statement for the S3 inventory as stated here:

https://docs.aws.amazon.com/AmazonS3/latest/dev/example-bucket-policies.html#example-bucket-policies-use-case-9

Otherwise the ACL on the files from the Inventory Report will block any access outside the account that owns the bucket where the inventory is saved.