S3 跨账号跨 Region 停机同步 Hands-On

验证：未记录

适用版本: 未记录
验证范围: 尚未登记验证记录。

本文缩写（英文全称与中文含义）

缩写	英文全称／名称	中文含义
AES256	Advanced Encryption Standard, 256-bit key	使用 256 位密钥的高级加密标准
AWS	Amazon Web Services	亚马逊云服务
CLI	Command-Line Interface	命令行接口
CRR	Cross-Region Replication	跨区域复制
GiB	Gibibyte	二进制容量单位，1 GiB = 2³⁰ 字节
IAM	Identity and Access Management	身份与访问管理
ID	Identifier	标识符
KMS	Key Management Service	密钥管理服务
MD5	Message-Digest Algorithm 5	消息摘要算法，不用于安全签名
S3	Simple Storage Service	AWS 对象存储服务
SSE	Server-Side Encryption	服务端加密

1. Scope#

目标：将 Account A source bucket 的当前对象一次性同步到 Account B / target Region bucket，然后弃用 Account A。

source/destination Versioning:
    not required for aws s3 sync

S3 Replication/CRR:
    not used
    would require Versioning on both buckets

history:
    only current objects are copied
    old versions/delete markers are not copied

对于不到约 100 GiB 的一次性迁移，优先使用 aws s3 sync。对象数量比总容量更影响耗时。

2. Permissions#

Assume the copy command uses this Account B role:

arn:aws:iam::222222222222:role/s3-migration-copy-role

Required permissions:

Account A source bucket policy:
    allow Account B role s3:ListBucket on the source prefix
    allow Account B role s3:GetObject on source objects

Account B role IAM policy:
    allow source ListBucket/GetObject
    allow destination ListBucket/PutObject/AbortMultipartUpload

Account B destination:
    use BucketOwnerEnforced
    destination bucket policy is optional when IAM role and bucket are in Account B

Source bucket policy example:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowAccountBListExport",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::222222222222:role/s3-migration-copy-role"
      },
      "Action": "s3:ListBucket",
      "Resource": "arn:aws:s3:::account-a-bucket",
      "Condition": {
        "StringLike": {
          "s3:prefix": [
            "export",
            "export/*"
          ]
        }
      }
    },
    {
      "Sid": "AllowAccountBReadExport",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::222222222222:role/s3-migration-copy-role"
      },
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::account-a-bucket/export/*"
    }
  ]
}

No bucket policy does not mean explicit deny. It means no resource-based allow exists. Same-account access can use IAM identity policy; cross-account source access needs the Account A resource policy allow.

3. Check Current Size#

Single prefix:

aws s3 ls s3://account-a-bucket/export/ --recursive --summarize --profile account-b | tail -n 2

Output:

Total Objects: 12345
Total Size: 98765432100

This performs LIST requests but does not download object bodies. For millions of objects, prefer S3 Inventory; for a small one-time migration, this scan is normally acceptable.

4. Stop Writes#

Stop all source PUT, overwrite and DELETE operations:

application uploads
background workers
scheduled cleanup jobs
admin scripts
Lifecycle rules that can expire objects during the migration

Without Versioning, an overwrite/delete during sync can make the destination inconsistent. Keep source writes stopped until validation and cutover complete.

5. Dry Run And Sync#

The source currently uses SSE-S3. No KMS key ID is required. --sse AES256 explicitly writes destination objects with SSE-S3.

Dry run:

aws s3 sync s3://account-a-bucket/export/ s3://account-b-bucket/export/ --source-region ap-east-1 --region ap-southeast-1 --profile account-b --sse AES256 --copy-props default --dryrun

Run:

aws s3 sync s3://account-a-bucket/export/ s3://account-b-bucket/export/ --source-region ap-east-1 --region ap-southeast-1 --profile account-b --sse AES256 --copy-props default --only-show-errors

Do not add --delete when the destination is empty. Only use it when the destination must exactly remove objects absent from source, and always test --dryrun --delete first.

Checks before running:

Glacier/Deep Archive objects are restored
destination prefix is correct
destination bucket has enough policy/KMS access
existing destination objects can be overwritten/skipped safely
metadata/tags are required and --copy-props default is supported by AWS CLI v2

6. Validate#

Run the same sync command with --dryrun again. No output means AWS CLI found no object requiring copy based on sync comparison rules.

Compare counts and bytes:

aws s3 ls s3://account-a-bucket/export/ --recursive --summarize --profile account-b | tail -n 2

aws s3 ls s3://account-b-bucket/export/ --recursive --summarize --profile account-b | tail -n 2

Sample destination encryption and metadata:

aws s3api head-object --profile account-b --region ap-southeast-1 --bucket account-b-bucket --key export/FILE.rdb --query '{Size:ContentLength,Encryption:ServerSideEncryption,Metadata:Metadata}'

Expected encryption:

AES256

Do not use multipart ETag as a universal MD5 checksum. For critical files, compare stored S3 checksums when available or perform an independent checksum verification.

放行与失败处置#

迁移前按执行边界记录停机预算、复制范围和校验策略。sync 非零退出、源端仍有变更、对象清单/摘要或必需元数据不符时，不切应用；修复后在源持续冻结条件下重跑，不能把再次 dry run 无输出当作字节级校验成功。

源与目标都无写入时，失败重试仍需确认目标未混入无关对象；不要加 --delete 清理未知数据。目标已有写入后，反向恢复要处理新增、覆盖、删除及其顺序，不能只拷贝新增对象；历史版本和删除标记不在本篇同步范围内。

最终用实际应用身份验证限定前缀内的读取，以及独立验收对象的写入/删除；确认事件通知、下游任务和旧端写入隔离符合预期。测试写入同样要纳入恢复记录。旧桶仅在恢复期结束、依赖已迁走后清理。

7. Cut Over#

1. keep Account A writes stopped
2. update application bucket/prefix and IAM to Account B
3. run read/write/delete smoke tests
4. resume writes only in Account B
5. retain Account A for an agreed rollback period
6. remove Account A only after final business validation

After Account B accepts writes, Account A is stale. A rollback requires reconciling target-side creates, overwrites and deletes before reverse migration, or an explicit business decision on data loss.

One-Time Migration