2

We transferred files from one bucket to another bucket on a separate account with --acl-public as follows:

s3cmd cp -v --recursive --acl-public s3://source-geo/webroot s3://dest-geo/webroot/

Now we files of s3://dest-geo/webroot/ are publicly accessible.

Through Amazon s3 console when we logged to destination with main account user (admin user) under permission section for all files its showing as “No permissions added...” .

We are able to download these files with out any issue but the issue is when we change acl, adding metadata, changing permission etc..

Through S3browser when we access permission of these files we are getting error as “Error occurred during Permission for . Access Denied.”

There is no issue for already existing buckets and newly created buckets. The issue is only with transferred files from another account.

Can anyone please help us on it.

2
  • So add the permissions needed.
    – EEAA
    Dec 20, 2014 at 13:45
  • @EEAA how to add is the question Nov 15, 2015 at 1:33

2 Answers 2

2

This is a bit old, but I recently ran into the same symptoms with an different solution.

We ended up with a bucket full of objects with no permissions. We could see them from the console, download them from the console, but not from our CLI tools. The objects showed in the console as having no permissions, but it was not possible to add or remove permissions from these objects over the AWS console, aws cli, s3cmd, etc, even after granting everyone(all-aws-users) access to the bucket from the CLI.

However, after some investigation it turned out that there was a policy set incorrectly on the bucket, denying all access except to a single, arbitrary IP address. This policy trumped the acl policy lists set on each object.

Once the policy was removed, the grant-all-access to the bucket took effect, and while the objects showed no permissions, it was possible to manipulate them normally again as described above.

1

I recommend to use AWS Cli instead of S3cmd. AWS cli is official tool for this by amazon. easy to install & use. also well documented.

To copy from a bucket to another. use s3 cp, example:

aws s3 cp s3://mybucket/ s3://mybucket2/ --recursive --exclude "mybucket/another/*"

To change permissions/acl public read for a bucket (this includes objects in bucket) use s3api put-bucket-acl

aws s3api put-bucket-acl --bucket MyBucket --grant-read 'uri="http://acs.amazonaws.com/groups/global/AllUsers"'
5
  • 1
    Thanks a lot. We are able to find the issue with aws s3api list-object-versions option. The issue is in which in destination bucket all objects that we transferred is having the ownership of source account. I can’t see any option to change ownership and while searching it recommends we need to again copy this is to destination itself to another bucket. So please let us know is there any option to change ownership either through aws cli or s3cmd?
    – GEO PC
    Dec 22, 2014 at 13:40
  • As far as i know there is no such thing as "ownership" for buckets or objects in S3. it works with ACL's which is well documented here. what you are trying to do is just copying object across the buckets. then give the public read permission for the target. up there in my answer exactly does this. if you configure an aws-cli in your environment. you will have to create new user via IAM. Assign that user as AWS administrator. you will see/modify all the ACL's on objects/buckets.
    – risyasin
    Dec 23, 2014 at 0:30
  • ACL documentation for S3: docs.aws.amazon.com/AmazonS3/latest/dev/acl-overview.html
    – risyasin
    Dec 23, 2014 at 0:31
  • 1
    @risyasin The S3 objects do have an owner. This is apparent, for example, when you delegate a bucket to a different account. When the delegatee uploads an object into the bucket, they are the owner for that object, and unless they apply --acl bucket-owner-full-control on the uploaded objects, the bucket owner cannot access them.
    – Ville
    Jan 5, 2018 at 20:05
  • 1
    @risyasin Further, when the ACL is applied as mentioned above (--acl bucket-owner-full-control), the owner of the object remains as 'awsadmin' while the bucket owner is given a FULL_CONTROL grant to it. If you do aws s3api get-object-acl --bucket mybucket --key myobject, you'll see that the "Owner" is 'awsadmin' for the delegatee uploaded objects, and your account owner's ID is the "Owner" for the objects that have been uploaded from your account.
    – Ville
    Jan 5, 2018 at 20:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .