跨AWS账户复制S3文件时遇AccessDenied错误排查

问题现象 #

尝试将其他AWS账户下的S3文件复制到自己账户时，持续报错：

An error occurred (AccessDenied) when calling the UploadPartCopy operation: Cannot access through this access point

已配置目标账户IAM用户权限和目标桶桶策略，且能通过CLI列出源文件，但复制失败。

已配置权限 #

目标账户IAM用户策略 #

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket",
                "s3:GetObject",
                "s3:GetObjectTagging",
                "s3:PutObjectTagging"
            ],
            "Resource": [
                "arn:aws:s3:us-west-2:620889225884:accesspoint/bulian-ai-mdl-parquet-1-access-point/*",
                "arn:aws:s3:us-west-2:620889225884:accesspoint/bulian-ai-mdl-parquet-1-access-point",
                "arn:aws:s3:::bulian-ai-mdl-parque-eziseoueyefwzsncu4iwr13fgpocyusw2b-s3alias/*",
                "arn:aws:s3:::bulian-ai-mdl-parque-eziseoueyefwzsncu4iwr13fgpocyusw2b-s3alias",
                "arn:aws:s3:::mobilelocationfeed.parquet.usw2.onemata.com/*",
                "arn:aws:s3:::mobilelocationfeed.parquet.usw2.onemata.com"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket",
                "s3:GetObject",
                "s3:PutObject",
                "s3:PutObjectAcl",
                "s3:GetObjectTagging",
                "s3:PutObjectTagging"
            ],
            "Resource": [
                "arn:aws:s3:::bulianai/",
                "arn:aws:s3:::bulianai/*"
            ]
        }
    ]
}

目标桶桶策略 #

{
    "Version": "2012-10-17",
    "Id": "Policy1611277539797",
    "Statement": [
        {
            "Sid": "Stmt1611277535086",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::864295014592:user/bulian_demo"
            },
            "Action": "s3:PutObject",
            "Resource": "arn:aws:s3:::bulianai/*",
            "Condition": {
                "StringEquals": {
                    "s3:x-amz-acl": "bucket-owner-full-control"
                }
            }
        },
        {
            "Sid": "Stmt1611277877767",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::864295014592:user/bulian_demo"
            },
            "Action": "s3:ListBucket",
            "Resource": "arn:aws:s3:::bulianai"
        }
    ]
}

补充信息 #

• 源桶路径：

s3://bulian-ai-mdl-parque-eziseoueyefwzsncu4iwr13fgpocyusw2b-s3alias/location_country=IN/output_year=2022/output_month=10/output_day=01/

• 目标桶路径：

s3://bulianai/OneMata/

排查及解决方法 #

1. 补充分块上传相关权限 #

当复制大文件时，AWS CLI会自动使用分块上传（UploadPartCopy），当前IAM用户策略中目标桶的权限未包含分块上传所需操作，需在目标桶的权限语句中添加以下Action：

"s3:UploadPart",
"s3:UploadPartCopy",
"s3:CompleteMultipartUpload"

更新后的目标桶权限语句示例：

{
    "Effect": "Allow",
    "Action": [
        "s3:ListBucket",
        "s3:GetObject",
        "s3:PutObject",
        "s3:PutObjectAcl",
        "s3:GetObjectTagging",
        "s3:PutObjectTagging",
        "s3:UploadPart",
        "s3:UploadPartCopy",
        "s3:CompleteMultipartUpload"
    ],
    "Resource": [
        "arn:aws:s3:::bulianai/",
        "arn:aws:s3:::bulianai/*"
    ]
}

2. 检查源访问点的权限配置 #

错误提示无法通过访问点访问，需确认源账户的访问点bulian-ai-mdl-parquet-1-access-point是否配置了允许你的IAM用户（arn:aws:iam::864295014592:user/bulian_demo）访问的策略。访问点策略独立于源桶策略，需确保其包含允许s3:GetObject等操作的语句，示例：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::864295014592:user/bulian_demo"
            },
            "Action": ["s3:GetObject", "s3:ListBucket"],
            "Resource": [
                "arn:aws:s3:us-west-2:620889225884:accesspoint/bulian-ai-mdl-parquet-1-access-point",
                "arn:aws:s3:us-west-2:620889225884:accesspoint/bulian-ai-mdl-parquet-1-access-point/*"
            ]
        }
    ]
}

需联系源账户管理员配置该访问点策略。

3. 确认复制命令的参数正确性 #

复制时需满足目标桶策略的ACL条件，执行复制命令时需指定--acl bucket-owner-full-control参数，示例：

aws s3 cp s3://bulian-ai-mdl-parque-eziseoueyefwzsncu4iwr13fgpocyusw2b-s3alias/location_country=IN/output_year=2022/output_month=10/output_day=01/ s3://bulianai/OneMata/ --recursive --acl bucket-owner-full-control

4. 排查访问点的网络限制 #

如果源访问点配置了VPC终端节点限制或IP白名单，需确保你的CLI访问环境符合该限制（比如在指定VPC内或IP在白名单中）。

内容的提问来源于stack exchange，提问作者Anurag-Sharma