To copy data from Partner AWS account S3 bucket to Customer AWS account S3 bucket using AWS CLI

There are two ways of doing it:

Source Account: Account A Target Account: Account B

1: Role chaining: Account A role would assume Account B role through sts:sassumerole and as long as - Account A has access to assume Account B role and it has access to s3 bucket from where data needs to be copied - Account B role trust relationship allows Account A role and has write access to the s3 bucket to where data would be copied

• Account A role permissions:

  {
     "Version": "2012-10-17",
     "Statement": {
     "Effect": "Allow",
     "Action": "sts:AssumeRole",
    "Resource": "arn:aws:iam::AccountB:role/AccountBRole"
      }
  

  }

• AccountA role should have AccountA s3 bucket read access

• AccountB Role trust relationship:

   {
       "Version": "2012-10-17",
       "Statement": [
       {
          "Effect": "Allow",
          "Principal": {
              "AWS": "arn:aws:iam::AccountA:role/AccountARole"
          },
         "Action": "sts:AssumeRole"
      }
    ]
  

  }

• AccountB tole should have AccountB s3 bucket write access

Since you mentioned external id, so I believe you are looking more towards assumerole mechanism and if so, then just be informed that external id is just an additional layer of security, which ensures that only those can assume target account role, who know the external id.

No better document can explain than this AWS Document. Similar re:Post thread also talks about role assumption.

2. Cross account s3 access:

     - Account B bucket policy allows Account A role for write access
   
     - Account A role has access to account B bucket in one of the attached policy to this role
   

Hope this helps.

Comment here if you have additional questions, happy to help.

Abhishek