使用AWS CLI跨账号复制S3文件遇AccessDenied错误求助

执行命令 aws s3 sync s3://account-b/ s3://account-a/，将文件从账号B复制到采用KMS密钥（aws/s3）加密的账号A桶时，报错：
An error occurred (AccessDenied) when calling the CopyObject operation: Access Denied

已完成的配置步骤 #

账号A #

1. 配置account-a桶策略：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Upload",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::12345676890:root"
            },
            "Action": [
                "s3:GetObject",
                "s3:GetObjectAcl",
                "s3:PutObject",
                "s3:PutObjectAcl"
            ],
            "Resource": [
                "arn:aws:s3:::account-a",
                "arn:aws:s3:::account-a/*"
            ]
        }
    ]
}

2. 创建角色kmss3bucket，附加KMS内联策略并配置信任关系：

内联策略：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "kms:Encrypt",
                "kms:Decrypt",
                "kms:ReEncrypt*",
                "kms:GenerateDataKey*",
                "kms:CreateGrant",
                "kms:DescribeKey"
            ],
            "Resource": "arn:aws:kms:us-east-1:9876543210:key/XXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXX"
        }
    ]
}

信任关系：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Service": "s3.amazonaws.com",
                "AWS": "arn:aws:iam::12345676890:root"
            },
            "Action": "sts:AssumeRole"
        }
    ]
}

账号B #

1. 创建跨账号策略并附加到某角色：

{
    "Version": "2012-10-17",
    "Statement": {
        "Effect": "Allow",
        "Action": "sts:AssumeRole",
        "Resource": "arn:aws:iam::9876543210:role/kmss3bucket"
    }
}

2. 该角色的信任关系配置：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Service": "s3.amazonaws.com",
                "AWS": "arn:aws:iam::9876543210:role/kmss3bucket"
            },
            "Action": "sts:AssumeRole"
        }
    ]
}

排查遗漏点 #

1. 账号B源桶权限缺失 #

执行sync命令的账号B身份（用户/角色）未获得自身源桶的访问权限，至少需要添加：

• s3:ListBucket（遍历源桶文件）
• s3:GetObject（读取源文件）
  当前仅配置了跨账号角色切换权限，无自身桶访问权限会导致无法读取待复制文件。

2. KMS密钥策略未显式授权目标角色 #

KMS密钥策略独立于IAM角色策略，需在账号A的KMS密钥策略中添加允许kmss3bucket角色的语句，仅给角色附加内联策略无效：

{
    "Sid": "AllowRoleUseKey",
    "Effect": "Allow",
    "Principal": {
        "AWS": "arn:aws:iam::9876543210:role/kmss3bucket"
    },
    "Action": [
        "kms:Encrypt",
        "kms:Decrypt",
        "kms:ReEncrypt*",
        "kms:GenerateDataKey*",
        "kms:DescribeKey"
    ],
    "Resource": "*"
}

3. 账号B角色信任关系配置错误 #

账号B的角色信任关系中，Principal设置为账号A的kmss3bucket角色逻辑错误，应允许账号B的身份（根用户/执行sync的角色）扮演该角色：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::12345676890:root"
            },
            "Action": "sts:AssumeRole"
        }
    ]
}

4. 同步命令未切换至账号A角色 #

直接用账号B身份执行sync不会自动切换到账号A的角色，需先获取临时凭证再执行命令：

1. 获取临时凭证：

aws sts assume-role --role-arn "arn:aws:iam::9876543210:role/kmss3bucket" --role-session-name "sync-s3"

2. 设置环境变量：

export AWS_ACCESS_KEY_ID="临时AccessKey"
export AWS_SECRET_ACCESS_KEY="临时SecretKey"
export AWS_SESSION_TOKEN="临时SessionToken"

3. 执行同步：

aws s3 sync s3://account-b/ s3://account-a/

5. 账号A桶策略未授权扮演后的角色 #

当前账号A桶策略仅授权账号B根用户，需添加允许kmss3bucket角色的语句：

{
    "Sid": "AllowAssumedRole",
    "Effect": "Allow",
    "Principal": {
        "AWS": "arn:aws:iam::9876543210:role/kmss3bucket"
    },
    "Action": [
        "s3:GetObject",
        "s3:GetObjectAcl",
        "s3:PutObject",
        "s3:PutObjectAcl"
    ],
    "Resource": [
        "arn:aws:s3:::account-a",
        "arn:aws:s3:::account-a/*"
    ]
}

内容的提问来源于stack exchange，提问作者Mark Andrew