AWS Cross - Account Access to S3 for Only Download

Table of Contents#

1. Core Concepts
2. Typical Usage Scenarios
3. Common Practices
4. Best Practices
5. Conclusion
6. FAQ
7. References

Article#

Core Concepts#

AWS Accounts and S3 Buckets#

An AWS account is a container for AWS resources. Each account has its own set of security credentials and permissions. An S3 bucket is a storage location in Amazon S3 where you can store objects (files). Buckets are globally unique within the Amazon S3 namespace.

Cross - Account Access#

Cross - account access allows resources in one AWS account to access resources in another AWS account. This is achieved through AWS Identity and Access Management (IAM) policies, bucket policies, and AWS Organizations.

Read - Only Access#

Read - only access to an S3 bucket means that the user or role can only retrieve objects from the bucket. They cannot create, modify, or delete objects. This is controlled through IAM policies that specify the allowed actions (e.g., s3:GetObject).

Typical Usage Scenarios#

Data Sharing for Analytics#

A data provider (e.g., a marketing agency) stores customer data in an S3 bucket in one AWS account. A data consumer (e.g., a data analytics company) in a different AWS account needs to download this data for analysis. The data provider wants to ensure that the consumer can only download the data and not make any changes.

Software Distribution#

A software company stores software packages in an S3 bucket in its AWS account. Partners or customers in different AWS accounts need to download these packages. The company wants to restrict access to only download operations to protect the integrity of the software.

Common Practices#

Using Bucket Policies#

A bucket policy is a JSON document attached to an S3 bucket that defines who can access the bucket and what actions they can perform. To enable cross - account read - only access, you can create a bucket policy that allows the principal (the AWS account or IAM role in the other account) to perform the s3:GetObject action on the bucket.

{
    "Version": "2012 - 10 - 17",
    "Statement": [
        {
            "Sid": "CrossAccountReadOnlyAccess",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::TARGET_ACCOUNT_ID:root"
            },
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::SOURCE_BUCKET_NAME/*"
        }
    ]
}

In this example, TARGET_ACCOUNT_ID is the AWS account ID of the account that needs access, and SOURCE_BUCKET_NAME is the name of the S3 bucket in the source account.

Using IAM Roles#

You can also create an IAM role in the source account that has read - only access to the S3 bucket. Then, you can configure the target account to assume this role.

1. Create an IAM Role in the Source Account:
   • Define a trust policy that allows the target account to assume the role.
   • Attach a permissions policy that grants read - only access to the S3 bucket.

{
    "Version": "2012 - 10 - 17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::TARGET_ACCOUNT_ID:root"
            },
            "Action": "sts:AssumeRole"
        }
    ]
}

2. Assume the Role in the Target Account:
   • Use the AWS SDK or AWS CLI to assume the role and obtain temporary security credentials.
   • Use these credentials to access the S3 bucket.

Best Practices#

Least Privilege Principle#

Apply the principle of least privilege by only granting the minimum permissions required. For example, if the user only needs to download specific objects, limit the permissions to those objects instead of the entire bucket.

Regularly Review and Update Policies#

As your organization's requirements change, review and update your bucket policies and IAM roles regularly. Remove any unnecessary permissions to reduce the risk of unauthorized access.

Enable AWS CloudTrail#

AWS CloudTrail provides a record of all API calls made in your AWS account. Enable CloudTrail to monitor and audit access to your S3 buckets. This helps you detect any suspicious activity and ensure compliance.

Conclusion#

AWS cross - account access to S3 for only download is a powerful feature that allows you to share data securely across different AWS accounts. By understanding the core concepts, typical usage scenarios, common practices, and best practices, you can set up such access in a way that meets your organization's security and compliance requirements.

FAQ#

Can I use both bucket policies and IAM roles for cross - account access?#

Yes, you can use both bucket policies and IAM roles together. Bucket policies provide a high - level access control at the bucket level, while IAM roles offer more fine - grained control and can be used to manage access on a per - user or per - application basis.

What if the target account needs to access multiple S3 buckets?#

You can either create separate bucket policies for each bucket or create an IAM role in the source account that has access to all the relevant buckets. Then, the target account can assume this role to access the buckets.

Is it possible to restrict access to specific IP addresses?#

Yes, you can add a condition to your bucket policy or IAM role to restrict access to specific IP addresses. For example:

{
    "Version": "2012 - 10 - 17",
    "Statement": [
        {
            "Sid": "CrossAccountReadOnlyAccess",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::TARGET_ACCOUNT_ID:root"
            },
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::SOURCE_BUCKET_NAME/*",
            "Condition": {
                "IpAddress": {
                    "aws:SourceIp": "192.0.2.0/24"
                }
            }
        }
    ]
}

References#

• AWS Documentation: Amazon S3 User Guide
• AWS Documentation: AWS Identity and Access Management User Guide
• AWS Documentation: AWS CloudTrail User Guide