AWS S3跨账户迁移复制

参考链接：

https://aws.amazon.com/blogs/storage/cross-account-bulk-transfer-of-files-using-amazon-s3-batch-operations/

Configuring replication when source and destination buckets are owned by different accounts - Amazon Simple Storage Service

Use S3 Batch Replication to replicate objects to another account and encrypt with AWS KMS - DEV Community

迁移方案

使用 S3 Batch Operation 功能将全量文件复制到目标桶使用

S3 CRR 功能将增量文件同步到目标桶

操作步骤：

条件前提：已在源账户和目的账户存在存储桶

权限配置：源账号

先进IAM,在左侧导航选择策略创建策略

点击json,将下面提供语句复制粘贴并修改成自己的资源

{

"Version": "2012-10-17",

"Statement": [

{

"Sid": "AllowBatchOperationsDestinationObjectCOPY",

"Effect": "Allow",

"Action": [

"s3:GetObjectVersionTagging",

"s3:PutObjectVersionTagging",

"s3:InitiateReplication",

"s3:GetReplicationConfiguration",

"s3:PutInventoryConfiguration",

"s3:ReplicateObject",

"s3:PutObject",

"s3:GetObjectAcl",

"s3:GetObject",

"s3:PutObjectVersionAcl",

"s3:GetObjectVersionAcl",

"s3:GetObjectTagging",

"s3:PutObjectTagging",

"s3:PutObjectAcl",

"s3:GetObjectVersion",

"s3:ObjectOwnerOverrideToBucketOwner",

"s3:GetObjectVersionForReplication",

"s3:ReplicateDelete",

"s3:ReplicateTags",

"s3:ListBucket"

],

"Resource": [

"arn:aws:s3:::ObjectDestinationBucket/*",

"arn:aws:s3:::ObjectDestinationBucket/",

"arn:aws:s3:::ObjectSourceBucket/*",

"arn:aws:s3:::ObjectSourceBucket",

"arn:aws:s3:::ObjectDestinationInventoryReportBucket/*",

"arn:aws:s3:::ObjectDestinationInventoryReportBucket"

]

}

]

}

ObjectDestinationBucket：是目标账户的桶 ObjectSourceBucke：源账户的桶

ObjectDestinationInventoryReportBucket： 在源账户里用来存放复制报告的桶

如果后续遇到什么期限问题也可以权限临时全开（如源桶账号为⾃主可控，可先attach s3-full-access 权限，后续控制最⼩权限）

然后输入策略名称，创建策略

在导航选择角色，创建角色

在搜索框内搜索S3选择S3，下一步

在搜索框刚才创建策略名称或者怕出现任何权限问题也可以临时选择AmazonS3FullAccess

然后在资源那里加上目标账户桶即可

输入角色名称创建即可

找到刚才创建的角色点击信任关系编辑信任策略，将以下语句加入

{

    "Version": "2012-10-17",

    "Statement": [

        {

            "Effect": "Allow",

            "Principal": {

                "Service": "s3.amazonaws.com"

            },

            "Action": "sts:AssumeRole"

        },

        {

            "Effect": "Allow",

            "Principal": {

                "Service": "batchoperations.s3.amazonaws.com"

            },

            "Action": "sts:AssumeRole"

        }

    ]

}

然后在源账户和目的账户的S3桶都开启版本控制

然后在目的桶的权限，编辑桶策略将以下语句加入

{

    "Version": "2012-10-17",

    "Id": "PolicyForDestinationBucket",

    "Statement": [

        {

            "Sid": "copy",

            "Effect": "Allow",

            "Principal": {

                "AWS": "arn:aws:iam::SourceBucket-account-ID:role/source-account-IAM-role"

            },

            "Action": [

                "s3:GetBucketVersioning",

                "s3:GetObjectAcl",

                "s3:GetObject",

                "s3:ReplicateObject",

                "s3:ReplicateDelete",

                "s3:PutObjectAcl",

                "s3:PutObjectVersionAcl",

                "s3:PutBucketVersioning",

                "s3:ObjectOwnerOverrideToBucketOwner",

                "s3:Put*",

                "s3:List*"

            ],

            "Resource": [

                "arn:aws:s3:::DESTINATION-BUCKET",

                "arn:aws:s3:::DESTINATION-BUCKET/*"

            ]

        }

    ]

}

arn:aws:iam::SourceBucket-account-ID:role/source-account-IAM-role：填写在源账户的创建的角色arn

arn:aws:s3:::DESTINATION-BUCKET:填写目标桶的arn

在源账户S3桶里管理中创建复制规则

保存之后等待任务完成

检查目标桶是否有数据