How to copy files from one AWS account to Another AWS Account

user_7869345 0
Viewed 1016

I need to move files from client S3 Buckets to our S3 Buckets. I tried few things:

  1. Using S3 browser copy and paste
  2. AWS CLI sync/cp but I got stuck how to pass access key and access id of source/destination location

Would you please give me some pointers. Thanks in advance.

aws-cli amazon-web-services amazon-s3
2 Answers

You have 2 options:

Pull files

Setup a bucket policy in your source granting read access to the user/role in the destination account. 

{
   "Version": "2012-10-17",
   "Statement": [
      {
         "Sid": "Example",
         "Effect": "Allow",
         "Action": [
            "s3:GetObject",
            "s3:ListBucket"
         ],
         "Principal": {
            "AWS": "arn:aws:iam::DEST_ACCOUNT:user/DestinationAccountUserName"
        },
         "Resource": [
            "arn:aws:s3:::source-bucket",
            "arn:aws:s3:::source-bucket/*"
         ]
      }
   ]
}

Then you can run aws s3 sync s3://source-bucket s3://dest-bucket with a user in the destination account.

Push files

Setup a bucket policy in your destination granting write access to the user/role in the source account. 

{
   "Version": "2012-10-17",
   "Statement": [
      {
         "Sid": "Example",
         "Effect": "Allow",
         "Action": [
            "s3:PutObject",
            "s3:PutObjectAcl"
         ],
         "Principal": {
            "AWS": "arn:aws:iam::SOURCE_ACCOUNT:user/SourceAccountUserName"
        },
         "Resource": [
            "arn:aws:s3:::dest-bucket"
         ],
         "Condition": {
            "StringEquals": {
               "s3:x-amz-acl": "bucket-owner-full-control"
            }
         }
      }
   ]
}

Then you can run aws s3 sync --acl bucket-owner-full-control s3://source-bucket s3://dest-bucket with a user in the source account. IMPORTANT If you don't set the ACL, the bucket owner in the destination account won't be able to access the objects, that's why we enforce the ACL in the "Condition".

Here's an AWS post about this: https://aws.amazon.com/es/premiumsupport/knowledge-center/cross-account-access-s3/

user_15036000

This article shows a few options...

  • AWS S3 console - suitable when dealing with a limited number of objects, or transferring within the same AWS account.
  • AWS command line interface (cli) - EC2 command line tool.
  • AWS S3 SDK - If you are ready to do some coding and write your own script.
  • s3cmd from s3tools.org - command line tool written in Python. Check out Alfie La Peter's article on this.
  • S3 Browser - Windows only.
  • CloudBerry S3 Explorer - Windows only, and at a price.
  • Bucket Explorer - Supports Windows, Mac and Linux (at a price).

  • CloudBuddy - MS Office plug-in.

  • S3Fox - Firefox add-on.

...and it also gives details on how to migrate using AWS CLI. Macro steps:

  • Create/Identify Buckets
  • Create IAM user account
  • Setup user credentials
  • Create a User Policy
  • Create Bucket Policy
  • Verify AWS S3 CLI availability on EC2 instance
  • Configure S3 CLI credentials
  • Finally copy and move some S3 objects
user_101695300
Related