How to Fix Accessdenied Calling Copyobject

On your IAM Role Policy side you will need the following:

  {
    "Version": "2012-10-17",
    "Statement": [
      {
          "Effect": "Allow",
          "Action": [
              "s3:ListBucket",
              "s3:GetObject",
              "s3:PutObject",
              "s3:PutObjectAcl"
          ],
          "Resource": [
              "arn:aws:s3:::BUCKET_A",
              "arn:aws:s3::: BUCKET_A/*"
          ]
      },
      {
          "Effect": "Allow",
          "Action": [
              "s3:ListBucket",
              "s3:GetObject",
              "s3:PutObject",
              "s3:PutObjectAcl"
          ],
          "Resource": [
              "arn:aws:s3:::BUCKET_B",
              "arn:aws:s3:::BUCKET_B/*"
          ]
      }
    ]
}

You need to add these permissions to BUCKET_B

{
         "Sid": "Example permissions",
         "Effect": "Allow",
         "Principal": {
            "AWS": "arn:aws:iam::your_iam_policy"
         },
         "Action": [
              "s3:ListBucket",
              "s3:GetObject",
              "s3:PutObject",
              "s3:PutObjectAcl"
          ],
         ],
         "Resource": [
            "arn:aws:s3:::BUCKET_B"
         ]
      }

In my case, I had no issues with some objects, however one of them had that same CopyObject error stated in the question. I was also using the sync command between cross-account buckets.

So I took a look at the Event History in AWS CloudTrail (since I had cloudtrail setup) - this helps to see what API calls are being invoked. However I did not have event logging for S3 buckets and objects enabled, so I tried a couple of changes, starting with put*, which worked. I then narrowed quickly to the one that I needed.

Ultimately, that let me to add this permission to my bucket policy: s3:PutObjectTagging.

Hope this helps you out too!

You'll need to configure AWS CLI on your local machine with the IAM user on B account.

You can have as many profiles as you'd like on your local cli configuration. Refer to AWS CLI configuration for more details.

Now while copying, add --profile parameter to your sync command. eg.

aws s3 sync s3://BUCKET_A s3://BUCKET_B --profile <NEW-AWS-CLI-PROFILE-FOR-ACCOUNT-B>

You are missing the s3:GetObjectTagging and s3:PutObjectTagging permissions as outlined here: .

In my case, it worked.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket",
                "s3:PutObject",
                "s3:GetObjectAcl",
                "s3:GetObject",
                "s3:PutObjectVersionAcl",
                "s3:GetObjectTagging",
                "s3:DeleteObject",
                "s3:GetBucketLocation",
                "s3:PutObjectAcl"
            ],
            "Resource": [
                "arn:aws:s3:::source-bucket/*",
                "arn:aws:s3:::destination-bucket/*",
                "arn:aws:s3:::source-bucket",
                "arn:aws:s3:::destination-bucket"
            ]
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": "s3:ListAllMyBuckets",
            "Resource": "*"
        }
    ]
}

This is probably related to the object's encryption in the destination bucket. Looking at the IAM role you pasted, looks like all the required permissions are granted.

To solve this problem, run the same command and add to it --sse AES256.

aws s3 sync s3://BUCKET_A s3://BUCKET_B --sse AES256

To check the encryption settings of the target bucket, you have to check the bucket policy, which should have the condition:

...
    "Condition": {
        "StringNotEquals": {
            "s3:x-amz-server-side-encryption": "AES256"
        }
    }
...

You can find the bucket policy in the tab Permissions => Bucket policy in S3 GUI, once you're in the destination bucket.