How can I copy S3 objects from another AWS account?

Last updated: 2019-09-09

I want to copy Amazon Simple Storage Service (Amazon S3) objects to a bucket in another AWS account. Then, I want to be sure that the destination account owns the copied objects. How can I do that? 

Resolution

To be sure that the destination account owns the copied objects, enable the destination account to perform the copy of objects from the source bucket to the destination bucket. Follow these steps:

Attach a policy to the source bucket

1.    Get the AWS account ID number of the destination account.

2.    From the source account, attach a policy to the source bucket that allows the destination account to get objects, similar to the following:
Important: For the value of Principal, be sure to enter the AWS account ID number of the destination account.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "DelegateS3Access",
            "Effect": "Allow",
            "Principal": {"AWS": "222222222222"},
            "Action": ["s3:ListBucket","s3:GetObject"],
            "Resource": [
                "arn:aws:s3:::sourcebucket/*",
                "arn:aws:s3:::sourcebucket"
            ]
        }
    ]
}

Attach a policy to a user or group in the destination account

Create a new AWS Identity and Access Management (IAM) customer managed policy that can be attached to the destination account's IAM user or group. The customer managed policy allows the user to copy objects from the source bucket to the destination bucket. The customer managed policy can be similar to the following example: 

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket",
                "s3:GetObject"
            ],
            "Resource": [
                "arn:aws:s3:::sourcebucket",
                "arn:aws:s3:::sourcebucket/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket",
                "s3:PutObject",
                "s3:PutObjectAcl"
            ],
            "Resource": [
                "arn:aws:s3:::destinationbucket",
                "arn:aws:s3:::destinationbucket/*"
            ]
        }
    ]
}

Copy objects from the source bucket to the destination bucket

After you set up the policies on the source bucket and the destination account, the destination account can copy objects from the source bucket to the destination bucket. Then, the destination account owns the objects copied into the destination bucket.

To synchronize all content from the source bucket to the destination bucket, you can run the S3 sync command: 

aws s3 sync s3://sourcebucket s3://destinationbucket