I've been reading multiple posts like this one about how to transfer data with aws cli from one S3 bucket to another using different accounts but I am still unable to do so. I'm sure it's because I haven't fully grasp the concepts of account + permission settings in AWS yet (e.g. iam account vs access key).

I have a vendor that gave me a user called "Foo" and account number "123456789012" with 2 access keys to access their S3 bucket "SourceBucket" in eu-central-1. I created a profile on my machine with the access key provided by the vendor called "sourceProfile". I have my S3 called "DestinationBucket" in us-east-1 and I set the bucket policy to the following.

{ "Version": "2012-10-17", "Id": "Policy12345678901234", "Statement": [ { "Sid": "Stmt1487222222222", "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::123456789012:user/Foo" }, "Action": [ "s3:PutObject", "s3:PutObjectAcl", "s3:GetObject", "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::DestinationBucket/", "arn:aws:s3:::DestinationBucket/*" ] } ] }

Here comes the weird part. I am able to list the files and even download files from the "DestinationBucket" using the following command lines.

aws s3 ls s3://DestinationBucket --profile sourceProfile aws s3 cp s3://DestinationBucket/test ./ --profile sourceProfile

But when I try to put copy anything to the "DestinationBucket" using the profile, I got Access Denied error.

aws s3 cp test s3://DestinationBucket --profile sourceProfile --region us-east-1 upload failed: ./test to s3://DestinationBucket/test An error occurred (AccessDenied) when calling the PutObject operation: Access Denied

Did I set up the bucket policy especially the list of action right? How could ls and cp from destination to local work but cp from local to destination bucket doesn't work?