跨账号S3数据同步（AWS DataSync）权限配置问题求助

核心角色作用梳理 #

首先明确你桶策略里两个Principal的区别：

• source-datasync-role：DataSync服务执行数据传输时会扮演这个角色，必须获得目标桶的完整操作权限，目标桶策略要明确信任这个角色。
• source-user-role：你运行Terraform时使用的身份（比如你的SSO角色），需要有创建DataSync Location的权限，包括访问目标桶的基础列表权限。

桶策略修正要点 #

你用的SSO角色ARN格式错误——带/myUserName的是会话级角色，不是角色本身的ARN。正确的SSO角色ARN格式是：
arn:aws:iam::<目标账号ID>:role/aws-reserved/sso.amazonaws.com/<区域>/AWSReservedSSO_AWSAdministratorAccess_<UUID>

修正后的目标桶策略示例：

{
  "Version": "2008-10-17",
  "Statement": [
    {
      "Sid": "DataSyncCreateS3LocationAndTaskAccess",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::源账号ID:role/source-datasync-role"
      },
      "Action": [
        "s3:GetBucketLocation",
        "s3:ListBucket",
        "s3:ListBucketMultipartUploads",
        "s3:AbortMultipartUpload",
        "s3:DeleteObject",
        "s3:GetObject",
        "s3:ListMultipartUploadParts",
        "s3:PutObject",
        "s3:GetObjectTagging",
        "s3:PutObjectTagging"
      ],
      "Resource": [
        "arn:aws:s3:::destination-bucket-test",
        "arn:aws:s3:::destination-bucket-test/*"
      ]
    },
    {
      "Sid": "DataSyncCreateS3Location",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::源账号ID:role/aws-reserved/sso.amazonaws.com/us-east-1/AWSReservedSSO_AWSAdministratorAccess_xxxxxx"
      },
      "Action": "s3:ListBucket",
      "Resource": "arn:aws:s3:::destination-bucket-test"
    }
  ]
}

Terraform配置修正 #

1. 配置双账号Provider #

确保同时配置源账号和目标账号的AWS Provider：

provider "aws" {
  alias  = "source"
  region = "us-east-1"
  # 源账号认证方式（比如SSO、环境变量）
}

provider "aws" {
  alias  = "destination"
  region = "us-east-1"
  # 目标账号认证方式
}

2. 正确关联目标桶资源 #

目标桶属于目标账号，需用aws.destination Provider声明：

resource "aws_s3_bucket" "destination-bucket" {
  provider = aws.destination
  bucket   = "destination-bucket-test"
}

3. 完善DataSync角色信任策略 #

确保source-datasync-role允许DataSync服务扮演：

resource "aws_iam_role" "datasync_source_role" {
  provider = aws.source
  name     = "source-datasync-role"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect = "Allow"
        Principal = {
          Service = "datasync.amazonaws.com"
        }
        Action = "sts:AssumeRole"
      }
    ]
  })
}

# 给角色附加必要的S3权限（可根据需求缩小范围）
resource "aws_iam_role_policy_attachment" "datasync_s3_access" {
  provider = aws.source
  role       = aws_iam_role.datasync_source_role.name
  policy_arn = "arn:aws:iam::aws:policy/AmazonS3FullAccess"
}

4. 修正Location配置 #

保持aws_datasync_location_s3.destination使用源账号Provider，但确保桶ARN引用正确：

resource "aws_datasync_location_s3" "destination" {
  provider      = aws.source
  s3_bucket_arn = aws_s3_bucket.destination-bucket.arn
  subdirectory  = "/"

  s3_config {
    bucket_access_role_arn = aws_iam_role.datasync_source_role.arn
  }
}

权限验证步骤 #

1. 验证用户权限：用你的SSO角色执行aws s3 ls s3://destination-bucket-test，确认能列出桶内容。
2. 验证DataSync角色权限：

   # 模拟DataSync角色获取临时凭证
   aws sts assume-role --role-arn <source-datasync-role-arn> --role-session-name datasync-test
   # 用返回的AccessKeyId、SecretAccessKey、SessionToken配置环境变量，执行
   aws s3 ls s3://destination-bucket-test
   

3. 检查桶策略生效：通过AWS控制台的S3桶权限页面，确认策略已正确应用且无语法错误。

内容的提问来源于stack exchange，提问作者DamDam