repos/notes
1
Fork 0
mirror of https://github.com/RealOrangeOne/notes.git synced 2024-12-22 13:16:22 +00:00
Code Activity

Expand on ACL issues

Browse source
This commit is contained in:
Jake Howard 2024-02-21 11:46:18 +00:00
parent 65e681742d
commit 4227e6da2f
Signed by: jake
GPG key ID: 57AFB45680EDD477
1 changed files with 10 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

17
docs/notes/infrastructure/cross-account-transfer.md → docs/notes/infrastructure/s3-cross-account-transfer.md
View file

@ -1,5 +1,5 @@
--- ---
title: Cross-account data transfer title: Cross-account data transfer in S3
tags: tags:
- AWS - AWS
sources: sources:
@ -49,11 +49,14 @@ To copy bucket contents from a bucket in account A to a bucket in account B:
Now, you can run `aws s3 sync` as the account in account B, and access both buckets. Now, you can run `aws s3 sync` as the account in account B, and access both buckets.
!!! warning ## ACLs
Whilst it might seem counter-intuitive, a **pull**-based transfer is significantly simpler than a **push**-based transfer. Notably, it avoids [issues](https://stackoverflow.com/a/63804619) with ownership issues and ACLs.
These can be solved by overwriting the file's ACLs to enforce the bucket owner owns the file: Whilst it might seem counter-intuitive, a **pull**-based transfer is significantly simpler than a **push**-based transfer. Notably, it avoids [issues](https://stackoverflow.com/a/63804619) with ownership issues and ACLs. Bucket policies don't seem to apply if the object is owned by a different account, which is the case when ACLs are enabled and the object is written by a user not in the organisation (hence pull-based being best).
``` These can be solved by overwriting the file's ACLs to enforce the bucket owner owns the file:
aws s3 cp --recursive 's3://<destination_bucket>` 's3://<destination_bucket>` --acl bucket-owner-full-control --metadata-directive REPLACE
``` ```
aws s3 cp --recursive 's3://<destination_bucket>` 's3://<destination_bucket>` --acl bucket-owner-full-control --metadata-directive REPLACE
```
It's then good practice to make sure the ACLs are as you expect (eg [`./manage.py fix_document_acls`](https://github.com/torchbox/wagtail-storages?tab=readme-ov-file#django-admin-fix_document_acls)).