Skip to content
By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post
About re:Post

Amazon Ads Cross-Account S3 Bucket Access

0

My organization has begun an Amazon Ads advertising campaign using Amazon Japan. I am able to download the campaign performance reports via the console. However, I am unable to programmatically access the bucket containing the supposed report. I know for sure the bucket is in my organization's S3 because I get "Bucket already exists" error when trying to create a new bucket with the same name.

Ref: https://advertising.amazon.co.jp/help/GRNBTHESSS5LMYPU

"An Amazon team creates an S3 bucket on behalf of the advertiser under an internal AWS account. They then grant access to that bucket to another AWS account according to the S3 bucket policy. These policies only allow programmatic access to the bucket, meaning you cannot see the shared bucket in the AWS console. To see the bucket in the AWS console, you would need to create an IAM user under your account, which is not allowed for security reasons. There are various libraries you can use to access the bucket programmatically"

  1. Everyone in my organization's AWS has tried aws s3 ls and can not see the report bucket.
  2. I've tried contacting supporting via the "Contact Us" button in the console but was told they can't offer help with regards to the S3 bucket access policies.

Has anyone had a similar experience and could offer insight as to how to access the bucket?

Thanks.

Topics
Advertising & MarketingSecurity, Identity, & Compliance
Tags
Advertising & MarketingAWS Identity and Access Management
Language
English

asked a year ago166 views

1 Answer
0

To access an S3 bucket that has been shared with your account by Amazon Ads, you need to understand that this is a cross-account access scenario where the bucket exists in Amazon's account, not yours.

The error "Bucket already exists" when trying to create a bucket with the same name doesn't necessarily mean the bucket is in your account - it simply means that bucket name is already taken in the global S3 namespace.

Since the bucket is shared programmatically (not visible in the console), here's how you can access it:

  1. First, ensure you have the correct IAM permissions in your account to access the shared bucket. You'll need an IAM policy that allows actions like s3:GetObject, s3:ListBucket on the specific bucket.

  2. When using AWS CLI or SDK, you need to specify the bucket name directly rather than trying to list all buckets:

  • For example: aws s3 ls s3://specific-bucket-name/
  • Or to download a specific report: aws s3 cp s3://specific-bucket-name/path/to/report local-destination
  1. If you're using an SDK, you'll need to create an S3 client with your credentials and then directly reference the bucket name in your operations.

The key point is that the bucket won't appear in your account's bucket list since it's owned by Amazon's account, but you can still access it directly by name if you have the proper permissions. Make sure you're using the exact bucket name provided by Amazon Ads in their documentation or communications.

If you're still having issues, you may need to contact Amazon Ads support specifically (not AWS support) as they would be the ones who configured the cross-account access.
Sources
Account A to access an S3 bucket in Account B | AWS re:Post
Cross account bucket access - Research and Engineering Studio

answered a year ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Relevant content