跨账号跨区域创建AWS DataSync任务遇权限错误求助

问题场景 #

尝试使用AWS DataSync将Account A的S3存储桶文件复制到Account B（不同区域）的S3存储桶，创建任务时触发如下错误：

Failed to create task
Request ID
23f8844d-7867-4b72-a02c-be52b0f2fz31
Action
datasync:CreateTask
Status code
400
API response
DataSync location access test failed: could not perform s3:HeadBucket on bucket <bucket_name>. Access denied. Ensure bucket access role has s3:ListBucket permission.

已完成官方教程步骤5前的所有操作，目标存储桶策略已为Account A的角色和用户配置s3:ListBucket权限，创建任务时以Account A的用户身份登录。目标存储桶策略如下：

{
  "Version": "2008-10-17",
  "Statement": [
    {
      "Sid": "DataSyncCreateS3LocationAndTaskAccess",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::account-a-id:role/name-of-role"
      },
      "Action": [
        "s3:GetBucketLocation",
        "s3:ListBucket",
        "s3:ListBucketMultipartUploads",
        "s3:AbortMultipartUpload",
        "s3:DeleteObject",
        "s3:GetObject",
        "s3:ListMultipartUploadParts",
        "s3:PutObject",
        "s3:GetObjectTagging",
        "s3:PutObjectTagging"
      ],
      "Resource": [
        "arn:aws:s3:::account-b-bucket",
        "arn:aws:s3:::account-b-bucket/*"
      ]
    },
    {
      "Sid": "DataSyncCreateS3Location",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::account-a-id:user/name-of-user"
      },
      "Action": "s3:ListBucket",
      "Resource": "arn:aws:s3:::account-b-bucket"
    }
  ]
}

问题原因 #

错误提示明确指出无法执行s3:HeadBucket操作，当前目标桶策略仅给Account A的用户配置了s3:ListBucket权限，缺少关键的s3:HeadBucket权限。DataSync在创建任务的访问测试环节，会先调用s3:HeadBucket验证桶的存在性和可访问性，这一步权限缺失直接导致任务创建失败。

解决方案 #

修改目标存储桶策略的第二个Statement，为Account A的用户添加s3:HeadBucket权限：

{
  "Version": "2008-10-17",
  "Statement": [
    {
      "Sid": "DataSyncCreateS3LocationAndTaskAccess",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::account-a-id:role/name-of-role"
      },
      "Action": [
        "s3:GetBucketLocation",
        "s3:ListBucket",
        "s3:ListBucketMultipartUploads",
        "s3:AbortMultipartUpload",
        "s3:DeleteObject",
        "s3:GetObject",
        "s3:ListMultipartUploadParts",
        "s3:PutObject",
        "s3:GetObjectTagging",
        "s3:PutObjectTagging"
      ],
      "Resource": [
        "arn:aws:s3:::account-b-bucket",
        "arn:aws:s3:::account-b-bucket/*"
      ]
    },
    {
      "Sid": "DataSyncCreateS3Location",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::account-a-id:user/name-of-user"
      },
      "Action": [
        "s3:ListBucket",
        "s3:HeadBucket"
      ],
      "Resource": "arn:aws:s3:::account-b-bucket"
    }
  ]
}

修改完成后重新尝试创建DataSync任务即可。此外需确认：

• Account A的IAM用户本身拥有datasync:CreateTask权限
• 源S3存储桶的权限配置正确，允许该用户或DataSync角色访问

内容的提问来源于stack exchange，提问作者zenc