The best way to copy data between Amazon S3 buckets in different accounts is to use a single set of credentials that has permission to read from the source bucket and write to the destination bucket.
You can then use these credentials with the CopyObject()
command, which will copy the object between the S3 buckets without the need to download and upload the objects. The copy will be fully managed by the Amazon S3 service, even if the buckets are in different accounts and even different regions. The copy will not involve transferring any data to/from your own computer.
If you use the AWS CLI aws s3 cp --recusive
or aws s3 sync
commands, the copies will be performed in parallel, making very fast copies of the objects.
There are two ways to perform a copy:
Push
- Use a set of credentials from the Source account that has permission to read from the source bucket
- Add a Bucket Policy on the destination bucket that permits Write access for these credentials
- When performing the copy, use
ACL=bucket-owner-full-control
to assign ownership of the object to the destination account
OR
Pull
- Use a set of credentials from the Destination account that has permission to write to the destination bucket
- Add a Bucket Policy on the source bucket that permits Read access for these credentials
- (No ACL is required because "pulling" the file will automatically give ownership to the account issuing the command)