I have been give access to a client's AWS S3 bucket using a cross account role. I have set up 2 profiles in my credentials file. One being our IAM account and the other having the cross account role and a reference to our account. Using the CLI I can copy files no problem. Now I try and do this using Python and Boto3. I can assume the role but then I can't copy the file, I get "Access Denied".
[client]
aws_access_key_id = XXXXXXXXX
aws_secret_access_key = xxxxxxxxxxxxxx
[client-car]
role_arn = arn:aws:iam::XXXXXXXXXX:role/MyCo-CrossAccountAccess-CrossAccountRole-XXXXXXXXXX
source_profile = client
external_id = 0x0x0x0x0x0x0x0x0x
If I use this in the CLI the copy works:
aws s3 cp my-local-file s3://mybucket/bucket-file --profile client-car
This is the Python code:
sts_client = boto3.client('sts',OUR-ACCOUNT-ACCESSKEY,OUR-SECRET)
account_id = sts_client.get_caller_identity()["Arn"]
assumed_role_object = sts_client.assume_role(RoleArn='arn:aws:iam::XXXXXXXXXX:role/MyCo-CrossAccountAccess-CrossAccountRole-XXXXXXXXXX',RoleSessionName='AssumeRoleSession1',ExternalId='0x0x0x0x0x0x0x0x0x')
credentials = assumed_role_object['Credentials']
# No problem until here
s3_client = boto3.client('s3',aws_access_key_id=credentials['AccessKeyId'],aws_secret_access_key=credentials['SecretAccessKey'],aws_session_token=credentials['SessionToken'])
filename = 'local file to copy'
objectname = 'testing6/testfile66'
bucketname = "the-clients-bucket"
response = s3_client.upload_file(filename,bucketname,objectname) # <- FAILS HERE AccessDenied