search

gatsby-uc / gatsby-plugin-s3

Deploy your gatsby site to a S3 bucket.
https://gatsby-plugin-s3.jari.io/
MIT License
210 stars 110 forks source link

Cross account S3 bucket deployments #294

Open ezrover opened 2 years ago

ezrover commented 2 years ago

This plugin works well with local buckets within the current account. However, when the s3://bucket-in-another-account is used, the deploy command errors out with Access Denied.

✖ Failed. AccessDenied: Access Denied

Even though IAM roles is setup correctly for the user/role to have full ss3 access in the other account. Also, the bucket policy in the other account is setup correctly to give user in the other account full s3 rights.

To resolve this issue, please follow https://aws.amazon.com/premiumsupport/knowledge-center/s3-bucket-owner-access/ and ensure for each object write, you add "--acl bucket-owner-full-control" .

YoshiWalsh commented 2 years ago

I don't have much experience with cross-account requests, but would it fix the problem if you set the Object Ownership settings on your bucket to "bucket owner enforced"? The documentation says that with this setting you don't need to specify any ACL.