AWS_Policies

To allow an IAM user in one AWS account (source) to copy or sync objects to an S3 bucket in another AWS account (destination), you need an IAM policy on the source account user and a bucket policy on the destination bucket.

Step 1 – IAM policy on the source account user

Attach this policy to the IAM user or role that will perform the copy. Replace the bucket ARNs with your actual source and destination bucket names.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowReadFromSource",
      "Effect": "Allow",
      "Action": ["s3:ListBucket", "s3:GetObject"],
      "Resource": [
        "arn:aws:s3:::source-bucket-name",
        "arn:aws:s3:::source-bucket-name/*"
      ]
    },
    {
      "Sid": "AllowWriteToDestination",
      "Effect": "Allow",
      "Action": ["s3:ListBucket", "s3:PutObject", "s3:PutObjectAcl"],
      "Resource": [
        "arn:aws:s3:::destination-bucket-name",
        "arn:aws:s3:::destination-bucket-name/*"
      ]
    }
  ]
}

Step 2 – Bucket policy on the destination bucket (Account B)

In Account B, add this policy to the destination bucket to allow Account A's IAM user to write:

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Principal": {
      "AWS": "arn:aws:iam::SOURCE_ACCOUNT_ID:user/USERNAME"
    },
    "Action": ["s3:PutObject", "s3:PutObjectAcl", "s3:ListBucket"],
    "Resource": [
      "arn:aws:s3:::destination-bucket-name",
      "arn:aws:s3:::destination-bucket-name/*"
    ]
  }]
}

Step 3 – Perform the sync

aws s3 sync s3://source-bucket-name s3://destination-bucket-name \
  --acl bucket-owner-full-control \
  --profile source-account-profile

The --acl bucket-owner-full-control flag ensures that Account B owns the objects after the transfer.