amazon-web-services - AWS Datasync S3 -> S3 跨账户，对目标角色/账户感到困惑

Question

我想使用 Datasync 将数据从一个账户中的单个 S3 存储桶复制到另一个账户中的单个 S3 存储桶。我正在关注这个官方 AWS Datasync 博客:https://aws.amazon.com/blogs/storage/how-to-use-aws-datasync-to-migrate-data-between-amazon-s3-buckets/在第二部分“跨帐户复制对象”中。
我已经设置了源和目标存储桶，并完成了“创建新的 IAM 角色并为源 S3 存储桶位置附加新的 IAM 策略”和“将以下信任关系添加到 IAM 角色”的初始步骤(您可以通过在引号中搜索这些字符串来了解我在博客中的意思)但我现在对使用哪个帐户“打开源 S3 存储桶策略并应用以下策略授予 IAM 角色访问权限”感到困惑对象”以及用于运行 AWS CLI 命令“aws sts get-caller-identity”的帐户，然后是“aws datasync create-location-s3”命令。我是在源帐户还是目标帐户上执行这些操作？该博客在这些具体步骤上有点困惑和不清楚，我在任何地方都找不到更简单的指南。

Answer 1

不工作! - https://aws.amazon.com/blogs/storage/how-to-use-aws-datasync-to-migrate-data-between-amazon-s3-buckets/
1) 目的地角色

在 所在的账户中创建必要的 IAM 角色目的地 S3 存储桶位于

登录 目的地帐户并为 AWS DataSync 创建 IAM 角色

  DESTINATION-ROLE:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Action:
              - sts:AssumeRole
            Effect: Allow
            Principal:
              Service:
                - datasync.amazonaws.com
      Path: '/'
      RoleName: DESTINATION-ROLE
  DESTINATION-POLICY:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: DESTINATION-POLICY
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Action:
              - s3:GetBucketLocation
              - s3:ListBucket
              - s3:ListBucketMultipartUploads
            Effect: Allow
            Resource: arn:aws:s3:::SOURCEBUCKET
          - Action:
              - s3:AbortMultipartUpload
              - s3:DeleteObject
              - s3:GetObject
              - s3:ListMultipartUploadParts
              - s3:PutObjectTagging
              - s3:GetObjectTagging
              - s3:PutObject
            Effect: Allow
            Resource: arn:aws:s3:::SOURCEBUCKET/*
      Roles:
        - Ref: DESTINATION-ROLE

2) 源 S3 政策

“复制您为源 S3 存储桶位置创建的 IAM 角色的 ARN。

现在，登录 来源帐户。

打开源 S3 存储桶策略并应用以下策略为 IAM 角色授予权限

Version: '2012-10-17'
Statement:
  - Sid: BucketPolicyForDataSync
    Effect: Allow
    Principal:
      AWS:
        - arn:aws:iam::DEST-ACCOUNT-ID:role/DESTINATION-ROLE
    Action:
      - s3:GetBucketLocation
      - s3:ListBucket
      - s3:ListBucketMultipartUploads
      - s3:AbortMultipartUpload
      - s3:DeleteObject
      - s3:GetObject
      - s3:ListMultipartUploadParts
      - s3:PutObject
      - s3:GetObjectTagging
      - s3:PutObjectTagging
    Resource:
      - arn:aws:s3:::SOURCEBUCKET
      - arn:aws:s3:::SOURCEBUCKET/*

3) CLI 调用

现在，启动 AWS CLI(来自来源 账户 )...

aws datasync create-location-s3                       \
    --s3-bucket-arn    'arn:aws:s3:::SOURCEBUCKET'    \
    --region           'us-east-1'                    \
    --s3-config '
        {
            "BucketAccessRoleArn":
                "arn:aws:iam::DEST-ACCOUNT-ID:role/DESTINATION-ROLE"
        }
    '

3.1) 错误源帐号

An error occurred (AccessDeniedException) when calling the CreateLocationS3 operation: Cross-account pass role is not allowed.

3.2) 错误目标账户

An error occurred (InvalidRequestException) when calling the CreateLocationS3 operation: Please provide a bucket in the us-east-1 region where DataSync is currently used.