Migrate AWS resources from one AWS Account to another AWS Account

Hello.

S3 allows you to migrate data to another AWS account using cross-account replication.
https://docs.aws.amazon.com/AmazonS3/latest/userguide/replication-walkthrough-2.html

DynamoDB also has several ways to migrate data to another AWS account.
Just choose your migration method based on your use case and you're good to go.
https://repost.aws/knowledge-center/dynamodb-cross-account-migration

With EFS, you can use VPC peering to connect a VPC in another account and then use the sync command to move data from EC2, and like DynamoDB, you can also use AWS Backup to perform cross-account copy.
It should also be possible to use DataSync.
https://repost.aws/knowledge-center/access-efs-across-accounts
https://aws.amazon.com/about-aws/whats-new/2019/05/aws-datasync-now-supports-efs-to-efs-transfer/?nc1=h_ls

Hi,

You may want to follow this blog post for guidance re. cross-account migration of AWS resources: https://aws.amazon.com/blogs/architecture/migrate-resources-between-aws-accounts/

Best,

Didier

Hello,

Migrating resources from one AWS account to another is a common task, and there are some straightforward ways to do it, especially for S3, DynamoDB, and EFS. Here's how you can handle each:

S3 Buckets: You can use S3 Cross-Account Replication to copy objects from the S3 bucket in your current account to a bucket in the new account. This way, any new data added to the source bucket is automatically replicated to the destination bucket. Here's a step-by-step guide on setting up cross-account replication: AWS S3 Cross-Account Replication. https://docs.aws.amazon.com/AmazonS3/latest/userguide/replication-walkthrough-2.html

DynamoDB Tables: You have several options for DynamoDB, like exporting the table to S3 and importing it into the new account or using the AWS Data Pipeline. Another method is to use the DynamoDB cross-account migration tool. Each method has its pros and cons, so pick the one that best fits your needs. For more details, check this out: DynamoDB Cross-Account Migration. https://repost.aws/knowledge-center/dynamodb-cross-account-migration

EFS: For EFS, you can use AWS DataSync to transfer data between EFS file systems in different accounts. Alternatively, if you already have EC2 instances set up, you can mount the EFS file system from the old account using VPC peering and then copy the files over. Here's a guide on EFS cross-account access: Access EFS Across Accounts. https://repost.aws/knowledge-center/access-efs-across-accounts

These methods will help you move your resources without too much hassle. If you want a more automated and managed solution, consider using AWS Backup to handle backups and cross-account recovery. This approach is secure and works well for all three services.

Take a look at the AWS DataSync feature too, which can simplify moving large amounts of data, especially for EFS: AWS DataSync for EFS. https://aws.amazon.com/about-aws/whats-new/2019/05/aws-datasync-now-supports-efs-to-efs-transfer/?nc1=h_ls

These should cover all you need to get started with migrating your AWS resources between accounts

Hello. Your approach to use resource-based policies to grant cross-account access for migrating active resources such as S3 buckets, DynamoDB tables, and EFS is valid and supported.

For Amazon S3, you can use bucket policies (resource-based policies) to allow another AWS account access to the buckets and objects. This is commonly done by specifying the other account's principal and defining allowed actions in the bucket policy.

For Amazon DynamoDB, AWS supports resource-based policies on tables to grant cross-account access. You attach a resource-based policy to the DynamoDB table in the source account that allows principals in the destination account to access it. The destination account users also need appropriate identity-based IAM policies to perform actions on the tables.

For Amazon EFS, you can use resource-based policies to grant cross-account access, for example, with POSIX permissions combined with file system policies that specify the AWS account or IAM principal from the destination account.

I hope this helps!