AWS S3 batch operation gets access denied

0
votes

I have created the following bucket policy in the source bucket

    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "kvmweivdgd",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::xxxxxxxxxxxx:role/cfn-batch-copy-role"
            },
            "Action": [
                "s3:GetObject",
                "s3:GetObjectVersion",
                "s3:GetObjectAcl",
                "s3:GetObjectTagging",
                "s3:GetObjectVersionAcl",
                "s3:GetObjectVersionTagging"
            ],
            "Resource": "arn:aws:s3:::sourcebucket/*"
        }
    ]
}

The following policy is attached to the destination account's IAM role

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "E28BGI8FL0HF59",
            "Effect": "Allow",
            "Action": [
                "s3:PutObject",
                "s3:PutObjectVersionAcl",
                "s3:PutObjectAcl",
                "s3:PutObjectVersionTagging",
                "s3:PutObjectTagging",
                "s3:GetObject",
                "s3:GetObjectVersion",
                "s3:GetObjectAcl",
                "s3:GetObjectTagging",
                "s3:GetObjectVersionAcl",
                "s3:GetObjectVersionTagging",
                "s3:GetBucketLocation"
            ],
            "Resource": [
                "arn:aws:s3:::destinationbucket/*",
                "arn:aws:s3:::sourcebucket/*",
                "arn:aws:s3:::manifestbucket/*",
                "arn:aws:s3:::jobreportbucket/*"
            ]
        }
    ]
}

But yet the AWS S3 batch operation throws access denied. Any ideas on what might be the problem here

1
amazon-web-servicesamazon-s3

1 Answers

1
votes

You need to attach the following trust policy to the IAM role to allow the Amazon S3 batch operations service principal to assume the role.

{
   "Version":"2012-10-17",
   "Statement":[
      {
         "Effect":"Allow",
         "Principal":{
            "Service":"batchoperations.s3.amazonaws.com"
         },
         "Action":"sts:AssumeRole"
      }
   ]
}