Terraform配置跨AWS账号S3存储桶复制报错求助

针对你遇到的InvalidArgument: The destination bucket owner is different from the one specified in Account报错，从以下几个方向排查解决：

1. 验证目标桶的实际账号ID #

确认var.replication_destination_account_id的值完全匹配目标桶所属的AWS账号ID：

• 用AWS CLI命令查询目标桶的账号信息：aws s3api get-bucket-acl --bucket <目标桶名称>，返回结果中的Owner.ID是目标桶所属账号的Canonical ID；同时在目标账号环境下执行aws sts get-caller-identity获取纯数字账号ID，确保var.replication_destination_account_id与该值完全一致。
• 检查是否存在输入错误，比如多写/少写数字、包含空格等。

2. 给目标桶配置正确的权限策略 #

目标桶必须允许源账号的复制角色执行复制相关操作，在目标账号的Terraform配置中添加Bucket Policy：

resource "aws_s3_bucket_policy" "destination_bucket_policy" {
  bucket = aws_s3_bucket.destination_bucket.id
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect = "Allow"
        Principal = {
          AWS = "<源账号复制角色的ARN>"
        }
        Action = [
          "s3:ReplicateObject",
          "s3:ReplicateDelete",
          "s3:ReplicateTags",
          "s3:GetObjectVersionTagging"
        ]
        Resource = [
          "${aws_s3_bucket.destination_bucket.arn}/*",
          aws_s3_bucket.destination_bucket.arn
        ]
      }
    ]
  })
}

3. 检查源账号复制角色的权限和信任策略 #

• 信任策略：确保复制角色允许S3服务扮演它，信任策略内容应为：

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "s3.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

• 权限策略：复制角色需要具备源桶的读取权限和目标桶的写入权限：

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObjectVersionForReplication",
        "s3:GetObjectVersionAcl",
        "s3:GetObjectVersionTagging"
      ],
      "Resource": "<源桶ARN>/*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "s3:ListBucket",
        "s3:GetReplicationConfiguration"
      ],
      "Resource": "<源桶ARN>"
    },
    {
      "Effect": "Allow",
      "Action": [
        "s3:ReplicateObject",
        "s3:ReplicateDelete",
        "s3:ReplicateTags"
      ],
      "Resource": "<目标桶ARN>/*"
    }
  ]
}

4. 确认源桶和目标桶都启用了版本控制 #

S3跨账号复制要求两端存储桶都开启版本控制，目标桶的Terraform配置需添加：

resource "aws_s3_bucket_versioning" "destination_bucket_versioning" {
  bucket = aws_s3_bucket.destination_bucket.id
  versioning_configuration {
    status = "Enabled"
  }
}

同时确认源桶的版本控制也处于启用状态。

5. 可选：移除冗余的account参数 #

如果已经确认目标桶账号ID和配置的值一致，但报错依旧，可以尝试移除destination块中的account参数——当设置access_control_translation { owner = "Destination" }时，S3会自动识别目标桶的账号，显式指定account反而可能因配置冲突导致报错。

内容的提问来源于stack exchange，提问作者bessey