AWS CLI syncing S3 buckets with multiple credentials

Question

I have read-only access to a source S3 bucket. I cannot change permissions or anything of the sort on this source account and bucket. I do not own this account.

I would like to sync all files from the source bucket to my destination bucket. I own the account that contains the destination bucket.

I have a separate sets of credentials for the source bucket that I do not own and the destination bucket that I do own.

Is there a way to use the AWS CLI to sync between buckets using two sets of credentials?

aws s3 sync s3://source-bucket/ --profile source-profile s3://destination-bucket --profile default

If not, how can I setup permissions on my owned destination bucket to that I can sync with the CLI?

Answer 1

The built-in S3 copy mechanism, at the API level, requires the request be submitted to the target bucket, identifying the source bucket and object inside the request, and using a single set of credentials that has both authorization to read from the source and write to the target.

This is the only supported way to copy from one bucket to another without downloading and uploading the files.

The standard solution is found at http://docs.aws.amazon.com/AmazonS3/latest/dev/example-walkthroughs-managing-access-example2.html.

You can grant their user access to write your bucket or they can grant your user access to their bucket... but copying from one bucket to another without downloading and re-uploading the files is impossible without the complicity of both account owners to establish a single set of credentials with both privileges.

Answer 2

For this use case, I would consider Cross-Region Replication Where Source and Destination Buckets Are Owned by Different AWS Accounts

... you set up cross-region replication on the source bucket owned by one account to replicate objects in a destination bucket owned by another account.

The process is the same as setting up cross-region replication when both buckets are owned by the same account, except that you do one extra step—the destination bucket owner must create a bucket policy granting the source bucket owner permission for replication actions.