For security reasons, I am working with two linked AWS accounts. Account A contains a RDS Aurora cluster and Account B contains an S3 Bucket. I have set up Aurora to be able to write to the S3 bucket as described in the documentation [1]. I can then run a query like the following:

SELECT * FROM sometable INTO OUTFILE S3 's3://accountbbucket/sometable_data' 

This all works wonderfully, except that the bucket owner in Account B does not have access to the objects written by Aurora in Account A. The objects default to permissions only for the object owner, with no permissions for the bucket owner.

In all my research, it appears that the only way to add the necessary permissions after the object has been created is with a user from Account A, but this breaks down the separation of accounts a bit.

I have found a documentation of how to specify canned ACLs when writing to an S3 bucket, but it is for Amazon EMR [2], not for Aurora.

Is there a similar way to specify the ACLs for a newly created S3 object written by Aurora?

[1] https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/AuroraMySQL.Integrating.SaveIntoS3.html

[2] https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-s3-acls.html

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.