{"id":15705,"date":"2025-09-12T12:51:20","date_gmt":"2025-09-12T07:21:20","guid":{"rendered":"https:\/\/www.skynats.com\/?p=15705"},"modified":"2025-09-12T12:51:22","modified_gmt":"2025-09-12T07:21:22","slug":"how-to-migrate-amazon-s3-data-across-accounts-and-regions-using-the-aws-cli","status":"publish","type":"post","link":"https:\/\/www.skynats.com\/blog\/how-to-migrate-amazon-s3-data-across-accounts-and-regions-using-the-aws-cli\/","title":{"rendered":"How to Migrate Amazon S3 Data Across Accounts and Regions Using the AWS CLI"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Migrating data between Amazon S3 buckets across AWS accounts and Regions can be a common requirement during cloud restructuring, account isolation, or data archiving strategies.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">We\u2019ll copy data from a source bucket in one AWS account to a destination bucket in another account, potentially in a different Region. This process ensures that the destination account becomes the new owner of the objects, and we\u2019ll achieve this through AWS S3 data transfer using AWS CLI.<\/p>\n\n\n\n<h2 class=\"wp-block-heading has-small-font-size\" id=\"h-tools-amp-services-used\"><strong>Tools &amp; Services Used<\/strong><\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Amazon S3<\/strong> \u2013 Object storage service<\/li>\n\n\n\n<li><strong>AWS CLI<\/strong> \u2013 Command line tool for AWS<\/li>\n\n\n\n<li><strong>AWS IAM<\/strong> \u2013 Identity and Access Management<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading has-small-font-size\" id=\"h-prerequisites\"><strong>Prerequisites<\/strong><\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Two AWS accounts (source and destination)<\/li>\n\n\n\n<li>Existing S3 buckets in both accounts<\/li>\n\n\n\n<li>IAM access to configure users, roles, and policies<\/li>\n\n\n\n<li><a href=\"https:\/\/aws.amazon.com\/\" target=\"_blank\" rel=\"noopener\"><mark style=\"background-color:rgba(0, 0, 0, 0)\" class=\"has-inline-color has-secondary-color\">AWS<\/mark><\/a> CLI installed on your system<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading has-small-font-size\" id=\"h-step-by-step-guide\"><strong>Step-by-Step Guide<\/strong><\/h2>\n\n\n\n<h2 class=\"wp-block-heading has-small-font-size\" id=\"h-create-iam-user-and-role-in-the-destination-account\"><strong>Create IAM User and Role in the Destination Account<\/strong><\/h2>\n\n\n\n<h2 class=\"wp-block-heading has-small-font-size\" id=\"h-create-an-iam-user\"><strong>Create an IAM User<\/strong><\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Go to IAM in the AWS Management Console<\/li>\n\n\n\n<li>Create a IAM user with programmatic access<\/li>\n\n\n\n<li>Download the access and secret keys<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading has-small-font-size\" id=\"h-create-a-policy-s3migrationpolicy\"><strong>Create a Policy (S3MigrationPolicy)<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Create a policy with the following permissions, replacing bucket names with your actual bucket names:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>{\n    \"Version\": \"2012-10-17\",\n    \"Statement\": &#91;\n        {\n            \"Effect\": \"Allow\",\n            \"Action\": &#91;\n                \"s3:ListBucket\",\n                \"s3:GetObject\",\n                \"s3:GetObjectTagging\",\n                \"s3:GetObjectVersion\",\n                \"s3:GetObjectVersionTagging\"\n            ],\n            \"Resource\": &#91;\n                \"arn:aws:s3:::amazon-s3-source-bucket\",\n                \"arn:aws:s3:::amazon-s3-source-bucket\/*\"\n            ]\n        },\n        {\n            \"Effect\": \"Allow\",\n            \"Action\": &#91;\n                \"s3:ListBucket\",\n                \"s3:PutObject\",\n                \"s3:PutObjectAcl\",\n                \"s3:PutObjectTagging\",\n                \"s3:GetObjectTagging\",\n                \"s3:GetObjectVersion\",\n                \"s3:GetObjectVersionTagging\"\n            ],\n            \"Resource\": &#91;\n                \"arn:aws:s3:::amazon-s3-destination-bucket\",\n                \"arn:aws:s3:::amazon-s3-destination-bucket\/*\"\n            ]\n        }\n    ]\n}<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading has-small-font-size\"><strong>Create IAM Role (S3MigrationRole)<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Create a role that can be assumed by the destination account IAM user:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>{\n    \"Version\": \"2012-10-17\",\n    \"Statement\": &#91;\n        {\n            \"Effect\": \"Allow\",\n            \"Principal\": {<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>              \"AWS\": \"arn:aws:iam::&lt;destination_account>:user\/&lt;user_name>\"\n            },\n            \"Action\": \"sts:AssumeRole\",\n            \"Condition\": {}\n        }\n    ]\n}<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Change the Amazon Resource Name (ARN) of the destination IAM user name according to your use case.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Attach the S3MigrationPolicy to this role S3MigrationRole.<\/p>\n\n\n\n<h3 class=\"wp-block-heading has-small-font-size\"><strong>Configure Bucket Policy in the Source Account<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">In the <strong>source S3 bucket<\/strong>, attach a bucket policy to allow access to the IAM role in the destination account:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": &#91;\n    {\n      \"Sid\": \"DelegateS3Access\",\n      \"Effect\": \"Allow\",\n      \"Principal\": {\n        \"AWS\": \"arn:aws:iam::&lt;destination-account-id>:role\/S3MigrationRole\"\n      },\n      \"Action\": &#91;\n        \"s3:ListBucket\",\n        \"s3:GetObject\",\n        \"s3:GetObjectTagging\",\n        \"s3:GetObjectVersion\",\n        \"s3:GetObjectVersionTagging\"\n      ],\n      \"Resource\": &#91;\n        \"arn:aws:s3:::source-bucket-name\/*\",\n        \"arn:aws:s3:::source-bucket-name\"\n      ]\n    }<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Replace &lt;destination-account-id> with your actual AWS account ID and S3MigrationRole with the name of the IAM role you created in your destination account.<\/p>\n\n\n\n<h2 class=\"wp-block-heading has-small-font-size\"><strong>Create the Destination S3 Bucket<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">If you haven&#8217;t already:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Go to S3 console in the <strong>destination account<\/strong><\/li>\n\n\n\n<li>Create a bucket in the desired Region<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading has-small-font-size\"><strong>Configure AWS CLI &amp; Assume Role<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Install the AWS CLI and configure it with the IAM user credentials. See the following link to configure AWS CLI &amp; Assume Role:- <a href=\"https:\/\/www.skynats.com\/blog\/how-do-i-assume-an-iam-role-using-the-aws-cli\/\">https:\/\/www.skynats.com\/blog\/how-do-i-assume-an-iam-role-using-the-aws-cli\/<\/a><\/p>\n\n\n\n<h3 class=\"wp-block-heading has-small-font-size\"><strong>Copy or Sync the Data<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Use one of the following commands to migrate data:<\/p>\n\n\n\n<h3 class=\"wp-block-heading has-small-font-size\"><strong>Copy all objects:<\/strong><\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>aws s3 cp s3:\/\/amazon-s3-source-bucket\/ \\\n    s3:\/\/amazon-s3-destination-bucket\/ \\\n    --recursive --source-region source-region-name --region destination-region-name<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading has-small-font-size\" id=\"h-synchronize-objects\"><strong>Synchronize objects:<\/strong><\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>aws s3 sync s3:\/\/amazon-s3-source-bucket\/ \\\n    s3:\/\/amazon-s3-destination-bucket\/ \\\n    --source-region source-region-name --region destination-region-name<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Replace the bucket and region names according to your setup in the above command.<\/p>\n\n\n\n<h3 class=\"wp-block-heading has-small-font-size\"><strong>Conclusion<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">This guide showed you how to perform a secure, one-time migration of S3 data across AWS accounts and Regions using the AWS CLI.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Handling AWS S3 data transfer using AWS CLI across accounts and regions can be complex. Skynats offers expert <a href=\"https:\/\/www.skynats.com\/aws-management\/\">AWS Management Services<\/a> to simplify migrations, ensure data security, and optimize performance. Contact us today for professional support.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Migrating data between Amazon S3 buckets across AWS accounts and Regions can be a common requirement during cloud restructuring, account isolation, or data archiving strategies. We\u2019ll copy data from a source bucket in one AWS account to a destination bucket in another account, potentially in a different Region. This process ensures that the destination account [&hellip;]<\/p>\n","protected":false},"author":14,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5],"tags":[722,730,1103,1006,352,1100,1101,1102],"class_list":["post-15705","post","type-post","status-publish","format-standard","hentry","category-blog","tag-aws","tag-aws-cli","tag-aws-iam","tag-aws-management-services","tag-aws-s3","tag-iam","tag-s3-bucket","tag-s3migrationpolicy"],"_links":{"self":[{"href":"https:\/\/www.skynats.com\/blog\/wp-json\/wp\/v2\/posts\/15705","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.skynats.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.skynats.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.skynats.com\/blog\/wp-json\/wp\/v2\/users\/14"}],"replies":[{"embeddable":true,"href":"https:\/\/www.skynats.com\/blog\/wp-json\/wp\/v2\/comments?post=15705"}],"version-history":[{"count":1,"href":"https:\/\/www.skynats.com\/blog\/wp-json\/wp\/v2\/posts\/15705\/revisions"}],"predecessor-version":[{"id":15706,"href":"https:\/\/www.skynats.com\/blog\/wp-json\/wp\/v2\/posts\/15705\/revisions\/15706"}],"wp:attachment":[{"href":"https:\/\/www.skynats.com\/blog\/wp-json\/wp\/v2\/media?parent=15705"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.skynats.com\/blog\/wp-json\/wp\/v2\/categories?post=15705"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.skynats.com\/blog\/wp-json\/wp\/v2\/tags?post=15705"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}