To upload file(s) to s3 bucket cross account using CodeBuild Project

Question

Hi AWS, we have restrictions in production account where we cannot do any write operations (GET, PUT, DELETE) either using AWS Console or CLI commands. We have a CodeBuild project in staging environment which can be used for it, so when I ran the following CLI command:

`aws s3 cp s3:/// s3:///`

I got the AccessDenied error with exit code 1, as we need to do [Role Chaining in order to upload the file to destination bucket cross account ](https://docs.aws.amazon.com/prescriptive-guidance/latest/patterns/copy-data-from-an-s3-bucket-to-another-account-and-region-by-using-the-aws-cli.html)

Having said that I figured out a way to upload the files to destination bucket cross account using S3 Presigned URL where you need to set up the IAM and bucket policies explicitly.

Here are the set of commands I ran:

```
      - echo "Generating Pre-Signed URL..."
      - SIGNED_URL=$(aws s3 presign s3://$SOURCE_BUCKET/$FILE_NAME --expires-in 600)
      - echo "Downloading file using pre-signed URL..."
      - curl -o $FILE_NAME "$SIGNED_URL"
      - echo "Uploading file to destination bucket..."
      - aws s3 cp $FILE_NAME s3://$DEST_BUCKET/
```

Can you please confirm if there is any other better way to do it or is there any harm from security perspective for using S3 Presigned URLs.

Riku_Kobayashi · Answer

Hello.

It is possible to restrict the source of uploads to an S3 bucket by implementing IP restrictions as shown below.  
CodeBuild can connect to a VPC, so you can access S3 using a NAT Gateway or a VPC endpoint.  
In other words, by restricting the source of connections using bucket policy, you can prevent uploads from outside even if a signed URL is misused.  
https://docs.aws.amazon.com/codebuild/latest/userguide/vpc-support.html  
```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "IPAllow",
            "Effect": "Deny",
            "Principal": "*",
            "Action": "s3:PutObject",
            "Resource": "arn:aws:s3:::example-bucket-name/*",
            "Condition": {
                "NotIpAddress": {
                    "aws:SourceIp": "NAT Gateway IP"
                }
            }
        }
    ]
}
```

If you want to restrict it by VPC endpoint, you can do the following:  
```
{
  "Id": "VPCe",
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "VPCe",
      "Action": "s3:PutObject",
      "Effect": "Deny",
      "Resource": "arn:aws:s3:::example-bucket-name/*",
      "Condition": {
        "StringNotEquals": {
          "aws:SourceVpce": [
            "VPC Endpoint ID"
          ]
        }
      },
      "Principal": "*"
    }
  ]
}
```

To upload file(s) to s3 bucket cross account using CodeBuild Project

Add your answer

Relevant content