How can I 'aws s3 sync' two buckets, which are located in different accounts

Question

I'm trying to use 'aws s3 sync' on the awscli between two accounts.

Account A, I own. Account B, Owned by a third party.

Account B has given a user:jon on account A permission to a bucket through a role:assumeDevOps assumption.

Jon assumes assumeDevOps to access bucket on Account B. But now I have to sync to a bucket back on account A.

I'm getting an access denied. Possibly because that role that Jon assumed has no permissions to the bucket back on my account.

How do I do this?

Is there documentation on this kind of situation?

Answer 1

Attach a policy to the source bucket

1. Get the AWS account ID number of the destination account.

2. From the source account, attach a policy to the source bucket that allows the destination account to get objects, similar to the following:

Important: For the value of Principal, be sure to enter the AWS account ID number of the destination account.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "DelegateS3Access",
            "Effect": "Allow",
            "Principal": {"AWS": "222222222222"},
            "Action": ["s3:ListBucket","s3:GetObject"],
            "Resource": [
                "arn:aws:s3:::sourcebucket/*",
                "arn:aws:s3:::sourcebucket"
            ]
        }
    ]
}

Attach a policy to a user or group in the destination account

Attach a policy to the destination account's IAM user or group that allows the user to copy objects from the source bucket to the destination bucket. The policy can be similar to the following example:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket",
                "s3:GetObject"
            ],
            "Resource": [
                "arn:aws:s3:::sourcebucket",
                "arn:aws:s3:::sourcebucket/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket",
                "s3:PutObject",
                "s3:PutObjectAcl"
            ],
            "Resource": [
                "arn:aws:s3:::destinationbucket",
                "arn:aws:s3:::destinationbucket/*"
            ]
        }
    ]
}

Copy objects from the source bucket to the destination bucket

After you set up the policies on the source bucket and the destination account, the destination account can copy objects from the source bucket to the destination bucket. Then, the destination account owns the objects copied into the destination bucket.

To synchronize all content from the source bucket to the destination bucket, you can run this command:

aws s3 sync s3://sourcebucket s3://destinationbucket

for more details check this link OR this link