
## Table of Contents

- [Introduction](#introduction)
- [Modify the S3 Bucket Policy](#modify-the-s3-bucket-policy)
- [For Single IP Address](#for-single-ip-address)
- [S3 Bucket with Multiple IP Addresses](#s3-bucket-with-multiple-ip-addresses)
- [Conclusion](#conclusion)

## Introduction

S3, Amazon Simple Storage Service, is an object cloud storage service that can
store data on the cloud and is designed for 99.999999999% (11 9's) of
durability. For example, you can host image files. You can either make the S3
bucket public so the images are publicly available, or you can keep the S3
bucket private and use CloudFront to access the S3 files. This blog shows how
to make it public with a specific IP address.

## Modify the S3 Bucket Policy

If you have an S3 bucket and want to allow access from a specific IP address,
you can modify the bucket policy as follows. Replace the bucket name and IP
address with your own values.

### For Single IP Address

```
{
    "Version": "2012-10-17",
    "Id": "S3PolicyId1",
    "Statement": [
        {
            "Sid": "IPAllow",
            "Effect": "Allow",
            "Principal": "*",
            "Action": "s3:*",
            "Resource": "arn:aws:s3:::{Your-S3-Bucket-Name}/*",
            "Condition": {
                "IpAddress": {
                    "aws:SourceIp": "{Your-IP-Address}/24"
                }
            }
        }
    ]
}
```

### S3 Bucket with Multiple IP Addresses

If you have multiple IP addresses you want to provide access to, you can do
the following.

```
{
    "Version": "2012-10-17",
    "Id": "S3PolicyId1",
    "Statement": [
        {
            "Sid": "IPAllow",
            "Effect": "Allow",
            "Principal": "*",
            "Action": "s3:*",
            "Resource": "arn:aws:s3:::{Your-Bucket-Name}/*",
            "Condition": {
                "IpAddress": {
                    "aws:SourceIp": [
                        "{Your-IP-Address-1}",
                        "{Your-IP-Address-2}"
                    ]
                }
            }
        }
    ]
}
```

## Conclusion

It is very easy to use the aws:SourceIp condition to limit specific IP
addresses for accessing your S3 bucket. If you just want to test it out with
your S3 bucket but don't want to make it fully public so everyone can access
them, you can simply add the IP address in the S3 policy editor.


S3, Amazon Simple Storage Service, is an object cloud storage service that can store data on the cloud and is designed for 99.999999999% (11 9's) of durability. For example, you can host image files. You can either make the S3 bucket public so the images are publicly available, or you can keep the S3 bucket private and use CloudFront to access the S3 files. This blog shows how to make it public with a specific IP address.

How To Enable S3 Bucket Access With IP Address


## Table of Contents

- [Introduction](#introduction)
- [Export DynamoDB Table to S3](#export-dynamodb-table-to-s3)
- [Destination Bucket Setup](#destination-bucket-setup)
- [AWS Configure](#aws-configure)
- [Execute the Command](#execute-the-command)
- [Migrate Data from S3 to DynamoDB](#migrate-data-from-s3-to-dynamodb)
- [Conclusion](#conclusion)

## Introduction

This blog shows how to migrate DynamoDB data between different AWS accounts.
You can migrate DynamoDB by using different approaches: 1. AWS S3 with AWS
Glue. 2. Data Pipeline. 3. Amazon EMR. Here, we'll use S3 and focus on how to
move DynamoDB backup data into a different AWS account.

Following is the process of handling migration from one AWS account to another
account and the requirements:

- Have an AWS account to use as the source account.

- The source account has a DynamoDB table and the S3 bucket the DynamoDB table
  will export to.

- Have an AWS account to use as the target account, and the S3 bucket which the
  source account will copy backup DynamoDB files into.

## Export DynamoDB Table to S3

Here, we'll export the DynamoDB table into the S3 bucket. Log in to AWS and
go to the DynamoDB section.

### Enable Point-in-Time Recovery

Before backing up the DynamoDB table to S3, you have to enable PITR
(point-in-time recovery). After enabling PITR, click Export to S3, then
choose the source table you want to back up to the same account's S3.

Enter the destination S3 bucket name and click the export button. The export
should now start and will copy all the backup files for the DynamoDB table
into the S3 bucket. Note that you can back up to a different AWS account
directly, but it's not covered in this blog.

### Add Bucket Policy to Source Bucket

After DynamoDB has been backed up to the S3 bucket, you'll need to modify the
bucket policy. Replace **ACCOUNT-B-ID** with account B's
ID, replace **ACCOUNT-B-USER** with account B's user who
will later perform the S3 file sync.
**ACCOUNT-A-Bucket-Name** should be replaced with the bucket that has the
DynamoDB backup content.

```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::{ACCOUNT-B-ID}:user/{ACCOUNT-B-USER}"
            },
            "Action": [
                "s3:ListBucket",
                "s3:GetObject"
            ],
            "Resource": [
                "arn:aws:s3:::{ACCOUNT-A-Bucket-NAME}/*",
                "arn:aws:s3:::{ACCOUNT-A-Bucket-NAME}"
           ]
        }
    ]
}
```

## Destination Bucket Setup

### Setup Custom Policy

For the destination bucket setup, we need to set up a user who has permission
to perform a bucket sync. The following policy grants access to both buckets.

```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket",
                "s3:GetObject"
            ],
            "Resource": [
                "arn:aws:s3:::{source bucket name}/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket",
                "s3:PutObject",
                "s3:PutObjectAcl"
            ],
            "Resource": [
                "arn:aws:s3:::{destination bucket name}/*"
            ]
        }
    ]
}
```

### Create a User and Attach the Policy

In the destination AWS account, create a new IAM user (or use an existing one)
that will be used to run the S3 sync command. Attach the custom policy you
created above to this user. Make sure to generate access keys for this user,
as you will need them in the next step to configure the AWS CLI.

### AWS Configure

Here, you'll run `aws configure` and use the credentials of the user who has
the custom policy attached.

### Execute the Command

At this point, both buckets should be ready and we can run the command to copy
files from account A's bucket to account B's bucket.

```
aws s3 sync s3://{source bucket name} s3://{target bucket name} --source-region {source region} --region {target region}
// following is example
aws s3 sync s3://my-dynamodb-backup s3://my-dynamodb --source-region us-west-2 --region us-west-1
```

### Migrate Data from S3 to DynamoDB

Now the S3 bucket should have the backup DynamoDB tables. There are a few ways
you can handle ETL to migrate data into DynamoDB. You can use a Glue Job
to read the files from the S3 bucket and write them to the target DynamoDB
table, or write a Lambda function to read the S3 files and write them into the
DynamoDB table. Following are a few possible ways to migrate data from S3 to
DynamoDB, but they are not part of this blog.

- Write a Glue Job

- Data Pipeline

- Write a Lambda function

- Use Amazon EMR

## Conclusion

Migrating DynamoDB data between AWS accounts involves exporting the table to
S3, setting up cross-account bucket policies, and syncing the data to the
destination account's S3 bucket. From there, you can use tools like AWS Glue,
Data Pipeline, Lambda, or Amazon EMR to load the data into the target DynamoDB
table. While there are several steps involved, following this process ensures
a reliable and secure migration.


This blog shows how to migrate DynamoDB data between different AWS accounts. You can migrate DynamoDB by using different approaches such as AWS S3 with AWS Glue, Data Pipeline, or Amazon EMR. Here, we'll use S3 and focus on how to move DynamoDB backup data into a different AWS account.

How to Backup DynamoDB Data to Different AWS Account


## Table of Contents

1. [Introduction](#introduction)
2. [Source Bucket Setup](#source-bucket-setup)
3. [Destination Bucket Setup](#destination-bucket-setup)
4. [Execute the Command](#execute-the-command)
5. [Conclusion](#conclusion)

## Introduction

This blog shows how to move S3 Bucket content from one AWS account to another
AWS account.

The scenario is that this blog assumes moving the S3 bucket
**technoapple.images** from AWS Account xxx to AWS Account yyy's
S3 bucket **ta.images**. It basically provides cross-account
access to S3 buckets.

## Source Bucket Setup

First, you need to go to Account A's bucket. In this blog's example, it should be
the **technoapple.images** bucket. Next, we'll need to add the Bucket
policy to Account A's bucket and replace a few values so Account B can
access it.

Replace **ACCOUNT-B-ID** with Account B's ID, replace
**ACCOUNT-B-USER** with Account B's user who will later
perform the S3 file sync, and replace **ACCOUNT-A-Bucket-Name** with
**technoapple.images**.

```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::{ACCOUNT-B-ID}:user/{ACCOUNT-B-USER}"
            },
            "Action": [
                "s3:ListBucket",
                "s3:GetObject"
            ],
            "Resource": [
                "arn:aws:s3:::{ACCOUNT-A-Bucket-NAME}/*",
                "arn:aws:s3:::{ACCOUNT-A-Bucket-NAME}"
           ]
        }
    ]
}
```

## Destination Bucket Setup

### Setup Custom Policy

For the destination bucket setup, we need to set up a user that has permission
to perform the bucket sync. The following policy specifies that we'll have access to
both buckets.

```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket",
                "s3:GetObject"
            ],
            "Resource": [
                "arn:aws:s3:::technoapple.images",
                "arn:aws:s3:::technoapple.images/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket",
                "s3:PutObject",
                "s3:PutObjectAcl"
            ],
            "Resource": [
                "arn:aws:s3:::ta.images",
                "arn:aws:s3:::ta.images/*"
            ]
        }
    ]
}
```

### Create a User and Attach the Policy

Create a new IAM user in Account B and attach the custom policy created above.

### AWS Configure

Here, you'll run `aws configure` and use the credentials of the user who has the custom
policy.

## Execute the Command

At this point, both buckets should be ready and we can run the command to copy
files from Account A's bucket to Account B's bucket.

```
aws s3 sync s3://{source bucket name} s3://{target bucket name} --source-region {source region} --region {target region}
// following is example
aws s3 sync s3://technoapple.images s3://ta.images --source-region us-west-2 --region us-west-1
```

## Conclusion

This blog shows how to move a bucket's files from one account to another
account. This will be useful if you want to retire one account and move files
to another account, or move S3 content between
development environments.


This blog shows how to move S3 Bucket content from one AWS account to another AWS account.

How to Sync S3 Bucket to Different AWS Account


## Table of Contents

1. [Introduction](#introduction)
2. [Setup IAM User with S3 Permission](#setup-iam-user-with-s3-permission)
3. [Require NPM Package for the Sample Code](#require-npm-package-for-the-sample-code)
4. [Update AWS Config and Create S3 Instance](#update-aws-config-and-create-s3-instance)
5. [Sample Code to List All Buckets](#sample-code-to-list-all-the-bucket)
6. [Sample Code to Upload a Text File to S3](#sample-code-to-upload-a-text-file-to-s3)
7. [Sample Code to Upload JSON File to S3](#sample-code-to-upload-json-file-to-s3)
8. [Sample Code to Upload an Image URL to S3](#sample-code-to-upload-an-image-url-to-s3)
9. [Upload Image File from Local](#upload-image-file-from-local)
10. [Conclusion](#conclusion)

## Introduction

S3 is a cloud serverless object storage solution provided by AWS. That means
you can store any files in S3 without maintaining the backend machine, and
managing these servers is AWS's responsibility. It is also very cheap. You
can reference the pricing for each region you'll be using for S3. For
example, at the time of writing (2020), when I checked US East Ohio, the standard S3
first 50 TB/month costs $0.023 per GB. The price also depends on how frequently you'll
access the file. If you just want to store some files
in S3 for a long time for archive purposes, you can use S3 Glacier Deep
Archive which costs $0.00099 per GB.

So, what I'm doing in this blog is showing some sample code for how to
upload files to AWS S3 by using Node.js.

## Setup IAM User with S3 Permission

The first thing you need to do before writing the Node.js code is to set up a user with S3 permissions to access your S3 bucket. I assume you
already have an AWS account set up. To make it easy, you could create a user
and provide the S3FullAccess policy for now, but for production, you should
always give the least privileges. Also, if you will be running Node.js on EC2 or
Lambda, you should create an IAM role and attach it to the EC2 or Lambda
instead of creating a user.

## Require NPM Package for the Sample Code

The following are packages that will be used by the code snippets later.

```
const AWS = require("aws-sdk");
const axios = require("axios");
```

## Update AWS Config and Create S3 Instance

Here, you update the AWS config to tell which region your bucket is in and add
the access key ID and secret access key to the S3 instance.

```
AWS.config.update({
        region: "us-west-2"
    });
    const s3 = new AWS.S3({
        accessKeyId: '{the access key id for the IAM user}',
        secretAccessKey: '{the secret access key for the IAM user}'
    });
```

## Sample Code to List All the Bucket

```
s3.listBuckets((err, data) => {
        if (err) {
            console.log("Error", err);
        } else {
            console.log("Success", data);
        }
    });
```

## Sample Code to Upload a Text File to S3

```
var textObjectParams = {Bucket: 'your bucket name', Key: '{the file name you want to create}.txt', Body: 'Yo! My first text!'};
    s3.upload(textObjectParams, (err, data) => {
        if (err) {
            console.log("Error", err);
        } else {
            console.log("Success", data);
        }
    });
```

## Sample Code to Upload JSON File to S3

```
var sampleData = {
        name: 'sample',
        count: '999'
    }

    var textObjectParams = {Bucket: '{Your bucket folder}', Key: 'jsonFile.json', Body: JSON.stringify(sampleData)};
    s3.upload(textObjectParams, (err, data) => {
        if (err) {
            console.log("Error", err);
        } else {
            console.log("Success", data);
        }
    });
```

## Sample Code to Upload an Image URL to S3

The following example uses Axios to get the image file as a stream, then upload
it to S3.

```
axios({
        method: 'GET',
        url: 'https://picsum.photos/536/354',
        responseType: 'stream'
    }).then(res => {
        var objectParams = {Bucket: '{Your bucket name}', Key: 'imageFile.png', Body: res.data};
        s3.upload(objectParams, (err, data) => {
            if (err) {
                console.log("Error", err);
            } else {
                console.log("Success", data);
            }
        });

    });
```

## Upload Image File from Local

```
const content = fs.readFileSync('yourImage.png');

    var objectParams = {Bucket: '{Your bucket name}', Key: 'new image file name.png', Body: content};

    s3.upload(objectParams, (err, data) => {
        if (err) {
            console.log("Error", err);
        } else {
            console.log("Success", data);
        }
    });
```

## Conclusion

The above examples show how to list buckets and upload different
kinds of files to AWS S3 by using Node.js, including text files, JSON files, images from URLs, and local image files.


This blog shows sample code for how to upload files to AWS S3 by using Node.js.

Upload to AWS S3 By Using Node.js


#### Table of Contents

1. Attach IAM role to private EC2 Instance
2. Create a new role and select the AmazonS3FullAccess.
3. enter the name and create the role
4. Attach the role to the private EC2 Instance
5. Create VPC EndPoint
6. Endpoints
7. SSH into Private EC2 Instance

This blog shows how to use VPC Endpoint from private EC2 Instance to S3
without going through the internet, with VPC Endpoint access s3 should be
within AWS service which will be no charge.

## Attach IAM role to private EC2 Instance

Since we'll need to access s3 from EC2 private instance, we'll need to set up
an s3 full access role for EC2 instance.

### Create a new role and select the AmazonS3FullAccess.

![](http://res.cloudinary.com/dmwrakaup/image/upload/c_fit,h_600,q_80,w_900/uupxrgghfivz1gfqrk65)

### enter the name and create the role

![](http://res.cloudinary.com/dmwrakaup/image/upload/c_fit,h_600,q_80,w_900/fseyxhqceun1jnyiklqc)

### Attach the role to the private EC2 Instance

![](http://res.cloudinary.com/dmwrakaup/image/upload/c_fit,h_600,q_80,w_900/bkpxw5dbuwhs5dx6zqwg)

## Create VPC EndPoint

### Endpoints

Go to VPC, click the **Endpoints** from Virtual private cloud. At
the Create Endpoint page, choose as following.

  - Service category: AWS services

  - Service name: choose s3, since we only want to access for s3 in this blog,
find the s3 from the list.

  - VPC: choose the VPC you created earlier.

  - Configure route tables: choose the private EC2 instance's route table,
should be the private route table

![](http://res.cloudinary.com/dmwrakaup/image/upload/c_fit,h_600,q_80,w_900/ongwitu8ubczp6uxxvol)

S3 full access role to private EC2

## SSH into Private EC2 Instance

Now, your private EC2 instance should be able to access to s3. Let's type ssh
into ec2 instance and type **aws s3 ls**. This command should
list of s3 buckets if has any.


VPC End Point - Use S3 from Private EC2 Instance


## Table of Contents

1. [Introduction](#introduction)
2. [Create the Target S3 Bucket](#create-the-target-s3-bucket)
3. [Configure S3 Replication](#configure-s3-replication)
4. [Review and Save](#review-and-save)
5. [Important Notes](#important-notes)
6. [Conclusion](#conclusion)

## Introduction

This blog shows how to use S3 replication within your current AWS account.

Before starting S3 cross-region or same-region replication, make sure the
target S3 bucket is ready. If you don't have a bucket, create a new bucket as
described below.

You can use S3 replication for many purposes. For example, you can
replicate S3 objects to different regions with different storage classes.

## Create the Target S3 Bucket

![](http://res.cloudinary.com/dmwrakaup/image/upload/c_fit,h_600,q_80,w_900/wv5fkrmd2ojfmzbvor4x)

Make sure S3 versioning is enabled because S3 replication requires versioning.

![](http://res.cloudinary.com/dmwrakaup/image/upload/c_fit,h_600,q_80,w_900/uxeiboza2uspgiui7wux)

Create the S3 bucket.

![](http://res.cloudinary.com/dmwrakaup/image/upload/c_fit,h_600,q_80,w_900/dwi88cxbsolhhxbk9wwd)

## Configure S3 Replication

For demo purposes, I have created an S3 bucket containing one file as
shown below.

![](http://res.cloudinary.com/dmwrakaup/image/upload/c_fit,h_600,q_80,w_900/xswn1ibiakbyxlzsimfj)

Click **Management** and click the replication option.

![](http://res.cloudinary.com/dmwrakaup/image/upload/c_fit,h_600,q_80,w_900/iv0rfnxe5zzpeuhh6zne)

Choose the **Replication rule** and select the source
bucket. Also, choose the target region.

![](http://res.cloudinary.com/dmwrakaup/image/upload/c_fit,h_600,q_80,w_900/ojz7t3q85xb0ypq0yczt)

![](http://res.cloudinary.com/dmwrakaup/image/upload/c_fit,h_600,q_80,w_900/fiyyqmyz2ytsq4rfgr3i)

Create an **IAM role**.

![](http://res.cloudinary.com/dmwrakaup/image/upload/c_fit,h_600,q_80,w_900/ompodwlkpj5njrugow0u)

## Review and Save

Review the replication rule. If everything looks good, click
**Save**.

![](http://res.cloudinary.com/dmwrakaup/image/upload/c_fit,h_600,q_80,w_900/mthxsimjjmtvjh07oui9)

You should see the "Replication configuration updated successfully" message. Now you are ready to replicate S3.

![](http://res.cloudinary.com/dmwrakaup/image/upload/c_fit,h_600,q_80,w_900/a9emxi7ub5ktlgrxl3ra)

## Important Notes

A few things to notice: deleting from the source bucket won't affect the
target bucket. However, adding to the source bucket will replicate to the
target bucket.

![](http://res.cloudinary.com/dmwrakaup/image/upload/c_fit,h_600,q_80,w_900/gghjp7boeym6pkkvgyxn)

## Conclusion

In this blog, we walked through setting up S3 cross-region replication within an AWS account. Key points to remember are: ensure versioning is enabled on both buckets, create the appropriate IAM role, and note that deletions are not replicated by default. S3 replication is useful for disaster recovery, compliance, and reducing latency for geographically distributed users.


This blog shows how to use S3 replication within your current AWS account for cross-region or same-region replication.

How to do S3 Cross Region Replication


## Table of Contents

- [Introduction](#introduction)
- [Create a Role in the Root Account](#create-a-role-in-the-root-account)
- [Add a User in the Child Account](#add-a-user-in-the-child-account)
- [Switch Roles to Access the Shared Bucket](#switch-roles-to-access-the-shared-bucket)
- [Conclusion](#conclusion)

## Introduction

This blog shows how to share an S3 bucket across different AWS accounts.

First, you'll need to set up multiple AWS accounts by using **AWS Organization**. You can reference this blog to see how to create an AWS Organization.

Once you have set up **AWS Organization**, make a note of the **AWS account ID** that has the S3 bucket you want to share with another AWS account. You'll need it later.

## Create a Role in the Root Account

Go to the root account's **IAM**, click **Roles** to create a new role.

![](https://res.cloudinary.com/dmwrakaup/image/upload/c_fit,h_600,q_80,w_900/vcikmqhaucnd6fmw3jlt)

Enter the **AWS account ID**.

![](https://res.cloudinary.com/dmwrakaup/image/upload/c_fit,h_600,q_80,w_900/c05iw7oasnungrlsv2m4)

Choose the **AmazonS3FullAccess** role.

![](https://res.cloudinary.com/dmwrakaup/image/upload/c_fit,h_600,q_80,w_900/wkww2nrb1qthiuyimbny)

Finish creating the role.

![](https://res.cloudinary.com/dmwrakaup/image/upload/c_fit,h_600,q_80,w_900/ahkrpkqbp6xfpkccabpk)

## Add a User in the Child Account

After finishing creating the role in the root account, we'll need to go to the child account to add a user.

![](https://res.cloudinary.com/dmwrakaup/image/upload/c_fit,h_600,q_80,w_900/rvwsqdptfjuiu7deykwe)

Add a user in the child account.

![](https://res.cloudinary.com/dmwrakaup/image/upload/c_fit,h_600,q_80,w_900/oolohttcqpfjvc1qeolh)

Add a new role to the user, and add the user to a group by creating a new group.

![](https://res.cloudinary.com/dmwrakaup/image/upload/c_fit,h_600,q_80,w_900/lyvq0tp7t2lmyl11muck)

Add **AdministratorAccess** when creating the new group.

![](https://res.cloudinary.com/dmwrakaup/image/upload/c_fit,h_600,q_80,w_900/of937zlou02x9cl0dxnu)

Successfully created a new user.

![](https://res.cloudinary.com/dmwrakaup/image/upload/c_fit,h_600,q_80,w_900/drmyjy1vef7h1hdrfmv4)

New admin group with **AdministratorAccess**.

![](https://res.cloudinary.com/dmwrakaup/image/upload/c_fit,h_600,q_80,w_900/wwwbkb03eacrystpufyd)

## Switch Roles to Access the Shared Bucket

After successfully creating this user, log in to AWS with the new user's username and password. After logging in, go to the user tab and select **Switch Roles**.

![](https://res.cloudinary.com/dmwrakaup/image/upload/c_fit,h_600,q_80,w_900/wigjbkctff6pvdtgzg9i)

Enter the account ID and the role name.

![](https://res.cloudinary.com/dmwrakaup/image/upload/c_fit,h_600,q_80,w_900/zcljhrx7o6r4kmic7rbr)

![](https://res.cloudinary.com/dmwrakaup/image/upload/c_fit,h_600,q_80,w_900/jgokyzerroyfyv7uu9mn)

![](https://res.cloudinary.com/dmwrakaup/image/upload/c_fit,h_600,q_80,w_900/txdnmlmxo1vjonuf0xkm)

## Conclusion

To share an S3 bucket between AWS accounts, you need to set up AWS Organization, create an IAM role with S3 access in the root account, add a user in the child account with appropriate permissions, and then use the Switch Roles feature to access the shared bucket. This approach provides a secure and manageable way to share resources across accounts.


This blog shows how to share an S3 bucket across different AWS accounts.