In a large company, you work as an AWS administrator. For a Windows SQL server instance, there is already a daily task to regularly transfer the database backup files to an S3 bucket (DB_Backup_1) in AWS account 111111111111. One data scientist asks you if it is possible to copy the latest backup file to another S3 bucket (DB_Backup_2) in his AWS account 222222222222. You plan to use AWS S3 CLI to do this. Which combinations of methods can accomplish this mission? (Select TWO.)

Answer options:

A.In account 111111111111, attach a bucket policy to DB_Backup_1 that allows the destination account 222222222222 to do the actions of "s3:ListBucket" and "s3:GetObject".
B.In account 111111111111, attach an Access Control List (ACL) policy to DB_Backup_1 that allows the destination account 222222222222 to do the actions of "s3:ListBucket" and "s3:PutObject".
C.In account 222222222222, attach an IAM policy to the IAM user or group that allows the data scientist user to copy objects from source bucket DB_Backup_1 to bucket DB_Backup_2.
D.In account 222222222222, attach a bucket policy to DB_Backup_2 that allows the destination account 222222222222 to do the actions of "s3:ListBucket" and "s3:PutObject".
E.In account 222222222222, attach an Access Control List (ACL) policy to DB_Backup_2 that allows the source account 111111111111 to do the actions of "s3:ListBucket", "s3:GetObject" and "s3:ListObject".

Correct Answer – A, C
Two items are required to enable the copy from an S3 bucket in the source account to another S3 bucket in the target account.
1, In the source AWS account, there is a bucket policy to allow the target account to ListBucket and GetObject.
2, In the target AWS account, there is an IAM policy for the IAM user (or group) to allow the user to copy the file from the source bucket (in source AWS account) to the target bucket (in target AWS account).
Option A is CORRECT: One example of this bucket policy is as below.
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "DelegateS3Access",
"Effect": "Allow",
"Principal": {"AWS": "222222222222"},
"Action": ["s3:ListBucket","s3:GetObject"],
"Resource": [
"arn:aws:s3:::sourcebucket/*",
"arn:aws:s3:::sourcebucket"
]
}
]
}
Some more details can be found in https://aws.amazon.com/premiumsupport/knowledge-center/copy-s3-objects-account/.
Option B is incorrect: Because it should be a bucket policy rather than an ACL policy. Besides, s3:GetObject is needed instead of s3:PutObject.
Option C is CORRECT: Because this allows the data scientist user to copy files (GetObject ) from the source bucket and put files (PutObject) in the target bucket.
Option D is incorrect: Because there is no need in the target account to put a bucket policy.
Option E is incorrect: Because in the target account, no Access Control List (ACL) policy is required. Instead, an IAM policy should exist to allow the file copy.