How to ‘aws s3 sync’ two buckets, which are located in different accounts

Scenario:

• AccountA - your account
• AccountB - customer account
• RoleA - Your account role to access DynamoDB, call STS, etc.
• RoleB - TrustedSecurityAuditor role in AccountB

You will need to manage two sets of credentials. Credentials A which are created from the IAM role assigned to the EC2 instance. Use these credentials to access your resources such as DynamoDB. Credentials B which are created via STS from RoleB. Use these credentials to access your customers resources.

You will then need to independently use the credentials based upon what you want to do. For example if you are using Python you would create two boto3 clients with different credentials.

The cause of your ListObjects error is that you assigned permission to access the contents of your bucket (arn:aws:s3:::bucket/*) but you did not give permissions to the bucket itself (arn:aws:s3:::bucket). The ListObjects command requires access to the bucket.

To test this, I did the following:

• Used two AWS accounts: Account A, Account B
• Created bucket-a in Account A
• Created bucket-b in Account B
• Created an IAM User user-a in Account A with permissions to access bucket-a

• Added a Bucket Policy to bucket-b:

  {
    "Id": "CopyBuckets",
    "Version": "2012-10-17",
    "Statement": [
      {
        "Sid": "Stmt1",
        "Action": "s3:*",
        "Effect": "Allow",
        "Resource": [
          "arn:aws:s3:::bucket-b",
          "arn:aws:s3:::bucket-b/*"
        ],
        "Principal": {
          "AWS": [
            "arn:aws:iam::<account-a-id>:user/user-a"
          ]
        }
      }
    ]
  }
  

I then triggered the sync by using user-a in Account A:

aws s3 sync s3://bucket-a s3://bucket-b --profile user-a

It worked successfully.