other account S3 mount

Question

Is it possible to mount S3 in another account? Mount uses s3fs. I added another account ID to the resource policy for IAM and S3, but the error for -curldbg is 403. It's the same even if you set S3 to public.

[ERR] curl.cpp:RequestPerform(2371): HTTP response code 403, returning EPERM. Body Text: <?xml version="1.0" encoding="UTF-8"?> <Error><Code>AccessDenied</Code><Message>Access Denied</Message><RequestId>2KX9M7E1H428Q4JV</RequestId><HostId>wAQcpWmsmFfzyZQ18g8DWgC4LZLLpv6w+jercfCqE4+fCsFIHhLXp3ZMRHQo3XIloGkdT7+nCfw=</HostId></Error> [ERR] curl.cpp:CheckBucket(3515): Check bucket failed, S3 response: <?xml version="1.0" encoding="UTF-8"?>

Is this possible? Is there a guide related to it?

Didier Durand · Answer

Hi,

Another to achieve your goal is to use Rclone: https://rclone.org/

```
What can rclone do for you?
Rclone helps you:

* Backup (and encrypt) files to cloud storage
* Restore (and decrypt) files from cloud storage
* Mirror cloud data to other cloud services or locally
* Migrate data to the cloud, or between cloud storage vendors
* Mount multiple, encrypted, cached or diverse cloud storage as a disk
* Analyse and account for data held on cloud storage using lsf, ljson, size, ncdu
* Union file systems together to present multiple local and/or cloud file systems as one

```

Best,

Didier

re:Post Agent · Answer

Yes, it is possible to mount an S3 bucket from another AWS account using s3fs, but it requires careful configuration of permissions and policies. The 403 error you're encountering suggests that there are still issues with the cross-account access permissions.

To successfully mount an S3 bucket from another account, you need to ensure the following:

1. The IAM role or user in your account has the necessary permissions to access the S3 bucket in the other account.

2. The S3 bucket policy in the other account allows access from your account.

3. If using KMS encryption, ensure that the KMS key policy allows cross-account access.

Here are some steps to troubleshoot and potentially resolve the issue:

1. Double-check the bucket policy in the account that owns the S3 bucket. Make sure it explicitly allows the necessary actions (like s3:GetObject, s3:ListBucket) for your account's IAM role or user.

2. Verify that the IAM role or user you're using with s3fs has the correct permissions to access the bucket.

3. If the bucket uses KMS encryption, ensure the KMS key policy allows your account to use the key.

4. When mounting with s3fs, use the -o iam_role option to specify the correct IAM role ARN that has permissions to access the bucket.

5. Try using the AWS CLI to test access to the bucket before attempting to mount it. This can help isolate whether the issue is with s3fs configuration or with the AWS permissions.

6. Check if there are any VPC endpoint policies or network ACLs that might be restricting access.

7. Ensure you're using the correct region when mounting the bucket.

If you've verified all these points and are still encountering issues, you might want to consider using AWS's native solution, Mountpoint for Amazon S3, which is optimized for cross-account access and high-performance file system-like access to S3 buckets.

Remember, making an S3 bucket public is generally not recommended for security reasons, especially for cross-account access. Instead, focus on setting up the correct cross-account IAM and bucket policies.  
**Sources**  
[Open Source File Client – Mountpoint for Amazon S3 – AWS](https://aws.amazon.com/s3/features/mountpoint/)  
[Community | AWS Cross Account S3 Access Through Lambda Functions](https://community.aws/content/2cCcsg05ZX2PoMHwMcWhv2BMlPL/aws-cross-account-s3-access-through-lambda-functions)  
[S3 Access Grants cross-account access - Amazon Simple Storage Service](https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-grants-cross-accounts.html)

other account S3 mount

Add your answer

Relevant content