S3 cross account permission (view via AWS UI and copy bucket content)-CodePudding

I'm trying to access (see it on my AWS console beside my own buckets) an external bucket ( bucket B ) and if possible copy it.

What permission (JSON file) do I need to ask from the owner of bucket B? is full read and full list permissions for my account enough? If I will receive the full read and the full list I will be able to see the bucket on my account under s3 buckets?

CodePudding user response：

Viewing / Downloading contents

The Amazon S3 management console only shows buckets in your own account.

However, you can 'cheat' and modify the URL to show another bucket for which you have access permission.

For example, when viewing the contents of a bucket in the S3 management console, the URL is:

https://us-east-1.console.aws.amazon.com/s3/buckets/BUCKET-NAME?region=ap-southeast-2&tab=objects

You can modify BUCKET-NAME to view a specific bucket.

Alternatively, you can access buckets via the AWS CLI, regardless of which account 'owns' the bucket, as long as you have sufficient permissions:

aws s3 ls s3://BUCKET-NAME

Required Permissions

The permissions you will need on the bucket depend totally on what you wish to do. If you want the ability to list the contents of the bucket, then you will need s3:ListBucket permission. If you want the ability to download an object, you will need s3:GetObject permission.

It would be something like this:

{
    "Version": "2012-10-17",
    "Statement": [
            {
            "Action": [
                "s3:ListBucket",
                "s3:GetObject"
            ],
            "Effect": "Allow",
            "Resource": [
                "arn:aws:s3:::BUCKET-NAME",
                "arn:aws:s3:::BUCKET-NAME/*"
            ],
            "Principal": {
                "AWS": [
                    "arn:aws:iam::111122223333:user/YOUR-USER-NAME"
                ]
            }
        }
    ]
}

When granting access, the owner of Bucket B will need to grant permissions to your IAM User (in your own AWS Account). Therefore, you will need to give them the ARN of your own IAM User.