Access Denied when syncing between s3 buckets on different AWS accounts

Question

I'm trying to setup sync between two buckets on different AWS accounts.

I got cp working with:

@ubuntu:~$ s3cmd cp -v s3://src/dir/ s3://dest/folder --recursive 

I am the user who owns /src/dir and I've added:

{ "Version": "2012-10-17", "Id": "Policy1477299702471", "Statement": [ { "Sid": "Stmt1477299696163", "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::awsid:user/name" }, "Action": "s3:*", "Resource": "arn:aws:s3:::bucket/*" } ]} 

To the bucket permissions policy on the test bucket.

Now I'm after aws sync to work, as using s3 cp is not recommended for using with cron.

I tried

user@ubuntu:~$ aws s3 sync --dryrun s3://src/ s3://dest/ --region eu-central-1 

but I get access denied:

fatal error: An error occurred (AccessDenied) when calling the ListObjects operation: Access Denied

How can I get access denied if this is the user who owns the bucket, and get sync running?

Answer 1

The cause of your ListObjects error is that you assigned permission to access the contents of your bucket (arn:aws:s3:::bucket/*) but you did not give permissions to the bucket itself (arn:aws:s3:::bucket). The ListObjects command requires access to the bucket.

To test this, I did the following:

• Used two AWS accounts: Account A, Account B
• Created bucket-a in Account A
• Created bucket-b in Account B
• Created an IAM User user-a in Account A with permissions to access bucket-a

• Added a Bucket Policy to bucket-b:

  { "Id": "CopyBuckets", "Version": "2012-10-17", "Statement": [ { "Sid": "Stmt1", "Action": "s3:*", "Effect": "Allow", "Resource": [ "arn:aws:s3:::bucket-b", "arn:aws:s3:::bucket-b/*" ], "Principal": { "AWS": [ "arn:aws:iam::<account-a-id>:user/user-a" ] } } ] } 

I then triggered the sync by using user-a in Account A:

aws s3 sync s3://bucket-a s3://bucket-b --profile user-a 

It worked successfully.