We frequently run into a situations where we wanted to sync assets between two S3 buckets in different accounts. For a long time, this was black magic to me, but the other day I wanted to finally track down how to pull it off.

Turns out it requires relatively few changes to get things working.

Let's say Account A has an AWS bucket and we’d like Account B to have access to that bucket so we can sync assets between them.

Bucket Policy on the Account A bucket

First we need to tell the bucket in account A that it’s okay for account B to have access. This takes the shape of a bucket policy

{
    "Version": "2008-10-17",
    "Statement": [
        {
            "Sid": "Statement1",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::{AcountBId}:user/{AcountBUsername}"
            },
            "Action": [
                "s3:GetObject",
                "s3:GetBucketLocation",
                "s3:ListBucket",
                "s3:GetObject",
                "s3:GetObjectAcl"
            ],
            "Resource": [
                "arn:aws:s3:::{AccountABucket}",
                "arn:aws:s3:::{AccountABucket}/*"
            ]
        }
    ]
}

Account B IAM policy

Next, we need to tell the user on Account B that it has access to the bucket in Account A. This takes the form of an IAM policy that looks like this:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:GetBucketLocation",
                "s3:ListBucket",
                "s3:GetObjectAcl"
            ],
            "Resource": [
                "arn:aws:s3:::{AccountABucket}",
                "arn:aws:s3:::{AccountABucket}/*"
            ]
        }
    ]
}

With these two pieces in place, you should be able to view and download assets within AccountABucket with the account B user.

aws s3 ls s3://{AccountABucket} --profile AccountBUser