轉移S3存儲內容到其他賬戶在不同的區域

Question

我試圖使用AWS CLI的S3存儲內容從

AWS account A -> Tokyo region (ap-northeast-1) -> S3 bucket -> account1bucket 

轉移到

AWS account B -> N.Virginia region (us-east-1) -> S3 bucket -> account2bucket 

遵循的步驟從https://aws.amazon.com/premiumsupport/knowledge-center/account-transfer-s3/通過創建準確的桶策略，IAM策略並執行以下命令：

這是給我下面的錯誤：使用Access ID /密鑰，並能夠成功連接到AWS account A但不AWS account B

對象資源管理器，鬥探險。我能看到的唯一區別是在AWS account B上啓用了MFA。從技術上講，這應該不成問題，因爲我能夠使用Access ID/Secret Key成功發佈內容到AWS account B Jenkins的S3存儲桶。

以下是政策的我已經在源桶水平和目的端用戶acconut級別定義：

AWS賬戶A S3鬥政策：

{ 
    "Version": "2012-10-17", 
    "Statement": [ 
     { 
      "Sid": "delegates3access", 
      "Effect": "Allow", 
      "Principal": { 
       "AWS": "arn:aws:iam::AWSAccountB:user/user@user.com" 
      }, 
      "Action": "s3:*", 
      "Resource": [ 
       "arn:aws:s3:::account1bucket/*", 
       "arn:aws:s3:::account1bucket" 
      ] 
     } 
    ] 
} 

AWS B賬戶用戶策略：

{ 
    "Version": "2012-10-17", 
    "Statement": { 
     "Effect": "Allow", 
     "Action": "s3:*", 
     "Resource": [ 
      "arn:aws:s3:::account1bucket", 
      "arn:aws:s3:::account1bucket/*", 
      "arn:aws:s3:::account2bucket", 
      "arn:aws:s3:::account2bucket/*" 
     ] 
    } 
} 

Answer 1

而不是使用AWS目標帳戶的憑據，使用AWS源帳戶憑據，並將它與下面的命令工作：

aws s3 sync s3://account1bucket s3://account2bucket --source-region ap-northeast-1 

Answer 2

您可能想要閱讀這篇優秀的博客文章S3跨區域複製https://aws.amazon.com/blogs/aws/new-cross-region-replication-for-amazon-s3/