将数据从一个AWS帐户中的S3 bucket复制到其他AWS帐户中的S3 bucket

Question

我正在尝试将S3 bucket对象从一个AWS复制到另一个AWS帐户。我在这里遵循了这个链接，它与一个帐户A一起工作，但当我与另一个帐户B一起使用时，会出现拒绝访问错误，这可能是什么原因？是不是跟一些防火墙或者安全问题有关，连源帐户B桶都公开了。这是应用于源桶B的策略

{

  "Version": "2012-10-17",

  "Statement": [

    {

      "Sid": "DelegateS3Access",

      "Effect": "Allow",

      "Principal": {

        "AWS": "arn:aws:iam::12345678910:user/abc"

      },

      "Action": [

        "s3:ListBucket",

        "s3:GetObject"

      ],

      "Resource": [

        "arn:aws:s3:::sourceBucketB/*",

        "arn:aws:s3:::sourceBucketB"

      ]

    }

  ]

}

这是应用于目标帐户的策略

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket",
                "s3:GetObject"
            ],
            "Resource": [
                "arn:aws:s3:::sourcebucket",
                "arn:aws:s3:::sourcebucket/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket",
                "s3:PutObject",
                "s3:PutObjectAcl"
            ],
            "Resource": [
                "arn:aws:s3:::destinationbucket",
                "arn:aws:s3:::destinationbucket/*"
            ]
        }
    ] }

我正在使用以下命令从bucket B复制到目标帐户（使用目标帐户配置文件）

Answer 1

此文档包含您所需的确切策略和必要步骤。

根据该文档，策略应该如下所示：

{
  "Version": "2012-10-17",
  "Statement": [
     {
        "Sid": "Example permissions",
        "Effect": "Allow",
        "Principal": {
           "AWS": "arn:aws:iam::AccountB-ID:root"
        },
        "Action": [
           "s3:GetBucketLocation",
           "s3:ListBucket"
        ],
        "Resource": [
           "arn:aws:s3:::sourcebucket"
        ]
     }
  ]
}