Answers: <p><strong>Attach a policy to the source bucket</strong></p>
  
  <ol>
  <li><p>Get the AWS account ID number of the destination account.</p></li>
  <li><p>From the source account, attach a policy to the source bucket that allows the destination account to get objects, similar to the following:</p></li>
  </ol>
  
  <p><strong>Important:</strong> For the value of <strong>Principal</strong>, be sure to enter the AWS account ID number of the destination account.</p>
  
  <pre><code>{
      "Version": "2012-10-17",
      "Statement": [
          {
              "Sid": "DelegateS3Access",
              "Effect": "Allow",
              "Principal": {"AWS": "222222222222"},
              "Action": ["s3:ListBucket","s3:GetObject"],
              "Resource": [
                  "arn:aws:s3:::sourcebucket/*",
                  "arn:aws:s3:::sourcebucket"
              ]
          }
      ]
  }
  </code></pre>
  
  <p><strong>Attach a policy to a user or group in the destination account</strong></p>
  
  <p>Attach a policy to the destination account's IAM user or group that allows the user to copy objects from the source bucket to the destination bucket. The policy can be similar to the following example:</p>
  
  <pre><code>{
      "Version": "2012-10-17",
      "Statement": [
          {
              "Effect": "Allow",
              "Action": [
                  "s3:ListBucket",
                  "s3:GetObject"
              ],
              "Resource": [
                  "arn:aws:s3:::sourcebucket",
                  "arn:aws:s3:::sourcebucket/*"
              ]
          },
          {
              "Effect": "Allow",
              "Action": [
                  "s3:ListBucket",
                  "s3:PutObject",
                  "s3:PutObjectAcl"
              ],
              "Resource": [
                  "arn:aws:s3:::destinationbucket",
                  "arn:aws:s3:::destinationbucket/*"
              ]
          }
      ]
  }
  </code></pre>
  
  <p><strong>Copy objects from the source bucket to the destination bucket</strong></p>
  
  <p>After you set up the policies on the source bucket and the destination account, the destination account can copy objects from the source bucket to the destination bucket. Then, the destination account owns the objects copied into the destination bucket.</p>
  
  <p>To synchronize all content from the source bucket to the destination bucket, you can run this command:</p>
  
  <pre><code>aws s3 sync s3://sourcebucket s3://destinationbucket
  </code></pre>
  
  <p>for more details check <a href="https://medium.com/tensult/copy-s3-bucket-objects-across-aws-accounts-e46c15c4b9e1" rel="nofollow noreferrer">this link</a> OR <a href="https://aws.amazon.com/premiumsupport/knowledge-center/copy-s3-objects-account/" rel="nofollow noreferrer">this link</a></p>
  
Answers: CC BY-SA 4.0
Answers: 2019-07-03T05:30:04.103Z
Answers: 2019-07-03T05:30:04.103Z
Answers: Subhash
Body: <p>I'm trying to use 'aws s3 sync' on the awscli between two accounts. </p>
  
  <p>Account A, I own.
  Account B, Owned by a third party. </p>
  
  <p>Account B has given a user:jon on account A permission to a bucket through a role:assumeDevOps assumption. </p>
  
  <p>Jon assumes assumeDevOps to access bucket on Account B. But now I have to sync to a bucket back on account A. </p>
  
  <p>I'm getting an access denied. Possibly because that role that Jon assumed has no permissions to the bucket back on my account.</p>
  
  <p>How do I do this?</p>
  
  <p>Is there documentation on this kind of situation?</p>
  
Tags: <amazon-web-services><amazon-s3><aws-cli><aws-iam>
Title: How can I 'aws s3 sync' two buckets, which are located in different accounts
UserDisplayName: phisshion
ThreadText: # How can I 'aws s3 sync' two buckets, which are located in different accounts
  
  (Asked by: username_0 on 2019-07-02)
  
  I'm trying to use 'aws s3 sync' on the awscli between two accounts.
  
  Account A, I own.
  Account B, Owned by a third party.
  
  Account B has given a user:jon on account A permission to a bucket through a role:assumeDevOps assumption.
  
  Jon assumes assumeDevOps to access bucket on Account B. But now I have to sync to a bucket back on account A.
  
  I'm getting an access denied. Possibly because that role that Jon assumed has no permissions to the bucket back on my account.
  
  How do I do this?
  
  Is there documentation on this kind of situation?
  
  **Tags:** amazon-web-services, amazon-s3, aws-cli, aws-iam
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2019-07-03. Score: 2
  
  **Attach a policy to the source bucket**
  
  1. Get the AWS account ID number of the destination account.
  2. From the source account, attach a policy to the source bucket that allows the destination account to get objects, similar to the following:
  
  **Important:** For the value of **Principal**, be sure to enter the AWS account ID number of the destination account.
  
  ```
  {
      "Version": "2012-10-17",
      "Statement": [
          {
              "Sid": "DelegateS3Access",
              "Effect": "Allow",
              "Principal": {"AWS": "222222222222"},
              "Action": ["s3:ListBucket","s3:GetObject"],
              "Resource": [
                  "arn:aws:s3:::sourcebucket/*",
                  "arn:aws:s3:::sourcebucket"
              ]
          }
      ]
  }
  
  ```
  
  **Attach a policy to a user or group in the destination account**
  
  Attach a policy to the destination account's IAM user or group that allows the user to copy objects from the source bucket to the destination bucket. The policy can be similar to the following example:
  
  ```
  {
      "Version": "2012-10-17",
      "Statement": [
          {
              "Effect": "Allow",
              "Action": [
                  "s3:ListBucket",
                  "s3:GetObject"
              ],
              "Resource": [
                  "arn:aws:s3:::sourcebucket",
                  "arn:aws:s3:::sourcebucket/*"
              ]
          },
          {
              "Effect": "Allow",
              "Action": [
                  "s3:ListBucket",
                  "s3:PutObject",
                  "s3:PutObjectAcl"
              ],
              "Resource": [
                  "arn:aws:s3:::destinationbucket",
                  "arn:aws:s3:::destinationbucket/*"
              ]
          }
      ]
  }
  
  ```
  
  **Copy objects from the source bucket to the destination bucket**
  
  After you set up the policies on the source bucket and the destination account, the destination account can copy objects from the source bucket to the destination bucket. Then, the destination account owns the objects copied into the destination bucket.
  
  To synchronize all content from the source bucket to the destination bucket, you can run this command:
  
  ```
  aws s3 sync s3://sourcebucket s3://destinationbucket
  
  ```
  
  for more details check [this link](https://medium.com/tensult/copy-s3-bucket-objects-across-aws-accounts-e46c15c4b9e1) OR [this link](https://aws.amazon.com/premiumsupport/knowledge-center/copy-s3-objects-account/)
  
  
  ---
  
  