S3 bucket policy - AWS Perspective

S3 bucket policy

Below is an example of an S3 bucket policy that will allow Cost and Usage Reports (CURs) to be uploaded to the bucket along with permissions to allow external accounts to replicate Objects into it. You will need to add the IAM Role from each external AWS account to this policy to grant permissions for the replication to take place.

{ "Version":"2012-10-17", "Id":"", "Statement":[ { "Sid":"Set permissions for objects", "Effect":"Allow", "Principal":{ "AWS":"arn-of-role-selected-in-replication-setup-in-source-account" }, "Action":["s3:ReplicateObject", "s3:ReplicateDelete"], "s3:ObjectOwnerOverrideToBucketOwner", "Resource":"arn:aws:s3:::destination-bucket-name/*" }, { "Sid":"Set permissions on bucket", "Effect":"Allow", "Principal":{ "AWS":"arn-of-role-selected-in-replication-setup-in-source-account" }, "Action":["s3:GetBucketVersioning", "s3:PutBucketVersioning"], "Resource":"arn:aws:s3:::destination-bucket-name " }, { "Sid": "Stmt1335892150622", "Effect": "Allow", "Principal": { "Service": "billingreports.amazonaws.com" }, "Action": [ "s3:GetBucketAcl", "s3:GetBucketPolicy" ], "Resource": "arn:aws:s3:::destination-bucket-name" }, { "Sid": "Stmt1335892526596", "Effect": "Allow", "Principal": { "Service": "billingreports.amazonaws.com" }, "Action": "s3:PutObject", "Resource": "arn:aws:s3:::destination-bucket-name/*" } ] }