How to fix AccessDenied calling CopyObject

Question

I'm trying to copy files from a bucket in A account to another bucket but in B account. When I try to sync the files with the command

aws s3 sync s3://BUCKET_A s3://BUCKET_B

It returns the following output:

copy failed: s3://BUCKET_A to s3://BUCKET_B An error occurred (AccessDenied) when calling the CopyObject operation: Access Denied

This is the policy that was attached to user created in in B account (where will be copied files from bucket A):

{
    "Version": "2012-10-17",
    "Statement": [
      {
          "Effect": "Allow",
          "Action": [
              "s3:ListBucket",
              "s3:GetObject",
              "s3:PutObject",
              "s3:PutObjectAcl"
          ],
          "Resource": [
              "arn:aws:s3:::BUCKET_A",
              "arn:aws:s3::: BUCKET_A/*"
          ]
      },
      {
          "Effect": "Allow",
          "Action": [
              "s3:ListBucket",
              "s3:GetObject",
              "s3:PutObject",
              "s3:PutObjectAcl"
          ],
          "Resource": [
              "arn:aws:s3:::BUCKET_B",
              "arn:aws:s3:::BUCKET_B/*"
          ]
      }
    ]
}

Probably I missing some permission? I don't find the permission CopyObject to add in my user/bucket policy

Solution 1

In my case, I had no issues with some objects, however one of them had that same CopyObject error stated in the question. I was also using the sync command between cross-account buckets.

So I took a look at the Event History in AWS CloudTrail (since I had cloudtrail setup) - this helps to see what API calls are being invoked. However I did not have event logging for S3 buckets and objects enabled, so I tried a couple of changes, starting with put*, which worked. I then narrowed quickly to the one that I needed.

Ultimately, that let me to add this permission to my bucket policy: s3:PutObjectTagging.

Hope this helps you out too!

Solution 2

You are missing the s3:GetObjectTagging and s3:PutObjectTagging permissions as outlined here: https://medium.com/collaborne-engineering/s3-copyobject-access-denied-5f7a6fe0393e.

Comments

[pmadhu]

Hi Nikhil, Improve your answer with additional information. Like explaining your code for better understanding.