How can I grant a user in another AWS account the access to upload objects to my Amazon S3 bucket?

Resolution

Note: If you receive errors when you run AWS Command Line Interface (AWS CLI) commands, then see Troubleshooting errors for the AWS CLI. Also, make sure that you're using the most recent AWS CLI version.

To grant access to a user in another account to upload objects to your S3 bucket, update IAM policies for either the user or their account. It's a best practice to control access through the account, with bucket owner enforced object ownership.

If your bucket uses access control lists (ACLs) instead of bucket owner enforced ownership, then consider the Amazon S3 configuration BucketOwnerEnforced, which turns off ACLs. Check whether your bucket uses ACLs with the following get-bucket-ownership-controls command:

aws s3api get-bucket-ownership-controls --bucket amzn-s3-demo-bucket

Note: Replace amzn-s3-demo-bucket with your bucket name.

If the output shows BucketOwnerPreferred or ObjectWriter instead of BucketOwnerEnforced, then your bucket uses ACLs. The uploader, not the bucket owner, owns cross-account uploaded objects.

Bucket owner enforced object ownership

To grant access for a bucket at the account level, use bucket owner enforced object ownership. Grant an IAM user from Account A access to upload objects to an S3 bucket in Account B with the following steps:

1. In Account A, create an IAM policy for users who need access to Account B's bucket::

   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Effect": "Allow",
         "Action": [
           "s3:PutObject",  
           "s3:ListBucket",  
           "s3:GetBucketLocation"
         ],
         "Resource": [
           "arn:aws:s3:::amzn-s3-demo-bucket",
           "arn:aws:s3:::amzn-s3-demo-bucket/*"
         ]
       }
     ]
   }

   Note: Replace amzn-s3-demo-bucket with your bucket name.

2. From Account A, get the Amazon Resource Name (ARN) of the IAM user.

3. From Account B, create a bucket policy that grants the cross-account user permission to upload objects:

   {
     "Version": "2012-10-17",
     "Statement": [
         {  
             "Sid": "CrossAccountUploadAccess",  
             "Effect": "Allow",  
             "Principal": {  
                 "AWS": "arn:aws:iam::111122223333:user/UploadData"  
             },  
             "Action": [  
                 "s3:PutObject"  
             ],  
             "Resource": "arn:aws:s3:::amzn-s3-demo-bucket/*"  
         },  
         {  
             "Sid": "CrossAccountListAccess",  
             "Effect": "Allow",  
             "Principal": {  
                 "AWS": "arn:aws:iam::111122223333:user/UploadData"  
             },  
             "Action": [  
                 "s3:ListBucket",  
                 "s3:GetBucketLocation"  
             ],  
             "Resource": "arn:aws:s3:::amzn-s3-demo-bucket"  
         }  
       ]
   }

   Note: For the value of Principal, be sure to enter the ARN of the IAM user in Account A. Replace amzn-s3-demo-bucket with your bucket name.

ACL enforced object ownership

To grant access for a bucket that uses ACL enforced object ownership, grant the PutObjectAcl permission in the bucket policy and the IAM user policy.

1. From Account A, attach a policy to the IAM user. The policy must allow the user to run the PutObject and PutObjectAcl actions on the bucket in Account B:

   {    
     "Version": "2012-10-17",  
     "Statement": [  
       {  
         "Effect": "Allow",  
         "Action": [  
           "s3:PutObject",  
           "s3:PutObjectAcl",  
           "s3:ListBucket",  
           "s3:GetBucketLocation"  
         ],  
         "Resource": [  
           "arn:aws:s3:::amzn-s3-demo-bucket",  
           "arn:aws:s3:::amzn-s3-demo-bucket/*"  
         ]  
       }  
     ]  
   }

   Note: Before you specify an ACL for the upload, you must have the s3:PutObjectAcl permission. Otherwise, you get an Access Denied error when you upload an object with an ACL, such as the bucket-owner-full control ACL.

2. From Account B, attach a bucket policy that grants the IAM user in Account A permission to run s3:PutObject and s3:PutObjectAcl actions:

   {  
     "Version": "2012-10-17",  
     "Statement": [  
         {  
             "Sid": "DelegateS3ObjectAccess",  
             "Effect": "Allow",  
             "Principal": {  
                 "AWS": "arn:aws:iam::999999999999:user/UploadData"  
             },    
             "Action": [  
                 "s3:PutObject",  
                 "s3:PutObjectAcl"  
              ],  
             "Resource": "arn:aws:s3:::amzn-s3-demo-bucket/*"  
         },  
         {  
             "Sid": "DelegateS3BucketAccess",  
             "Effect": "Allow",  
             "Principal": {  
                 "AWS": "arn:aws:iam::111122223333:user/UploadData"  
             },  
               "Action": [  
                   "s3:ListBucket",  
                   "s3:GetBucketLocation"  
               ],  
               "Resource": "arn:aws:s3:::amzn-s3-demo-bucket"  
           }  
       ]  
   }

Related information

Example 2: Bucket owner granting cross-account bucket permissions