Skip to content

Commit

Permalink
Merge pull request #25 from aws-ia/fix
Browse files Browse the repository at this point in the history
Fix 0.0.2
  • Loading branch information
prabirsekhri authored Aug 30, 2024
2 parents 7bfef2b + 9a067f3 commit 3a217b5
Show file tree
Hide file tree
Showing 3 changed files with 14 additions and 26 deletions.
14 changes: 6 additions & 8 deletions .header.md
Original file line number Diff line number Diff line change
Expand Up @@ -47,7 +47,7 @@ module "s3_location" {
}
```

Note that the Datasync S3 locations module allows you to create a DataSync IAM role by setting ```create_role = true```. This IAM role has the required [S3 permissions](https://docs.aws.amazon.com/datasync/latest/userguide/create-s3-location.html#create-role-manually) allowing DataSync service to seamlessly access the S3 bucket.
Note that the Datasync S3 locations module allows you to create a DataSync IAM role by setting `create_role = true`. This IAM role has the required [S3 permissions](https://docs.aws.amazon.com/datasync/latest/userguide/create-s3-location.html#create-role-manually) allowing DataSync service to seamlessly access the S3 bucket.

EFS Location

Expand Down Expand Up @@ -105,19 +105,17 @@ AWS DataSync can transfer data between Amazon S3 buckets that belong to differen
- Source account: The AWS account for managing the S3 bucket that you need to transfer data from.
- Destination account: The AWS account for managing the S3 bucket that you need to transfer data to.

Here is the paragraph with the grammar and spelling corrected:

With the launch of the S3 feature Amazon S3 Object Ownership, S3 bucket-level settings can be used to disable access control lists (ACLs) and take ownership of every object in your bucket. It is no longer necessary to configure a cross-account AWS DataSync task to ensure that the destination account owns all of the objects copied over to its S3 bucket. Now, you can just use S3 Object Ownership to ensure that your destination account automatically owns all of the objects copied over to its S3 bucket.

It's important that all the data that you transfer to the S3 bucket from another account belongs to your destination account. To ensure that this account owns the data, disable the bucket's access control lists (ACLs) prior to the data transfer.

This example creates the necessary DataSync resources, including DataSync locations (Source and Destination), Task, and associated IAM roles for S3 access in the source AWS account. The resources related to the destination location (target S3 bucket) are created in the Destination AWS account. It uses IAM policies and resource-based bucket policies to manage cross-account access to DataSync.

AWS provider is used to interact with the resources in the cross accounts.The AWS Provider can source credentials and other settings from the shared configuration and credentials files. By default, these files are located at ```$HOME/.aws/credentials``` on Linux and macOS, and ```%USERPROFILE%\.aws\config``` and ```%USERPROFILE%\.aws\credentials``` on Windows.
AWS provider is used to interact with the resources in the cross accounts.The AWS Provider can source credentials and other settings from the shared configuration and credentials files. By default, these files are located at `$HOME/.aws/credentials` on Linux and macOS, and `%USERPROFILE%\.aws\config` and `%USERPROFILE%\.aws\credentials` on Windows.

Providers are configured as environment variables as below with the corresponding profiles configured at ```~/.aws/credentials```. Here is a quick reference on [how to configure a credential file](https://docs.aws.amazon.com/cli/v1/userguide/cli-configure-files.html) and use [AWS Provider](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#static-credentials).
Providers are configured as environment variables as below with the corresponding profiles configured at `~/.aws/credentials`. Here is a quick reference on [how to configure a credential file](https://docs.aws.amazon.com/cli/v1/userguide/cli-configure-files.html) and use [AWS Provider](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#static-credentials).

**Example of ```~/.aws/credentials``` file :**
**Example of `~/.aws/credentials` file :**

```
[source-account]
Expand Down Expand Up @@ -186,9 +184,9 @@ module "s3_dest_location" {
}
```

By default ```create_role``` is set to ```false``` for the destination location as the IAM role is created outside the [DataSync Locations Module](modules/datasync-locations/).
By default `create_role` is set to `false` for the destination location as the IAM role is created outside the [DataSync Locations Module](modules/datasync-locations/).

The ```depends_on``` meta-argument ensures that terraform creates the destination Datasync location only after the destination account S3 bucket policy is updated to allowing the source account IAM role to transfer data to destination account bucket.
The `depends_on` meta-argument ensures that terraform creates the destination Datasync location only after the destination account S3 bucket policy is updated to allowing the source account IAM role to transfer data to destination account bucket.

**Note:** Task creation would fail if the destination account's S3 bucket policy does not allow the source account's IAM role, as DataSync would verify read/write access to the source and destination S3 buckets before configuring the task.

Expand Down
23 changes: 6 additions & 17 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -48,8 +48,7 @@ module "s3_location" {
}
```

Note that the Datasync S3 locations module allows you to create a DataSync IAM role by setting ```create_role = true
```. This IAM role has the required [S3 permissions](https://docs.aws.amazon.com/datasync/latest/userguide/create-s3-location.html#create-role-manually) allowing DataSync service to seamlessly access the S3 bucket.
Note that the Datasync S3 locations module allows you to create a DataSync IAM role by setting `create_role = true`. This IAM role has the required [S3 permissions](https://docs.aws.amazon.com/datasync/latest/userguide/create-s3-location.html#create-role-manually) allowing DataSync service to seamlessly access the S3 bucket.

EFS Location

Expand Down Expand Up @@ -107,24 +106,17 @@ AWS DataSync can transfer data between Amazon S3 buckets that belong to differen
- Source account: The AWS account for managing the S3 bucket that you need to transfer data from.
- Destination account: The AWS account for managing the S3 bucket that you need to transfer data to.

Here is the paragraph with the grammar and spelling corrected:

With the launch of the S3 feature Amazon S3 Object Ownership, S3 bucket-level settings can be used to disable access control lists (ACLs) and take ownership of every object in your bucket. It is no longer necessary to configure a cross-account AWS DataSync task to ensure that the destination account owns all of the objects copied over to its S3 bucket. Now, you can just use S3 Object Ownership to ensure that your destination account automatically owns all of the objects copied over to its S3 bucket.

It's important that all the data that you transfer to the S3 bucket from another account belongs to your destination account. To ensure that this account owns the data, disable the bucket's access control lists (ACLs) prior to the data transfer.

This example creates the necessary DataSync resources, including DataSync locations (Source and Destination), Task, and associated IAM roles for S3 access in the source AWS account. The resources related to the destination location (target S3 bucket) are created in the Destination AWS account. It uses IAM policies and resource-based bucket policies to manage cross-account access to DataSync.

AWS provider is used to interact with the resources in the cross accounts.The AWS Provider can source credentials and other settings from the shared configuration and credentials files. By default, these files are located at ```$HOME/.aws/credentials
``` on Linux and macOS, and ```%USERPROFILE%\.aws\config
``` and ```%USERPROFILE%\.aws\credentials
``` on Windows.
AWS provider is used to interact with the resources in the cross accounts.The AWS Provider can source credentials and other settings from the shared configuration and credentials files. By default, these files are located at `$HOME/.aws/credentials` on Linux and macOS, and `%USERPROFILE%\.aws\config` and `%USERPROFILE%\.aws\credentials` on Windows.

Providers are configured as environment variables as below with the corresponding profiles configured at ```~/.aws/credentials
```. Here is a quick reference on [how to configure a credential file](https://docs.aws.amazon.com/cli/v1/userguide/cli-configure-files.html) and use [AWS Provider](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#static-credentials).
Providers are configured as environment variables as below with the corresponding profiles configured at `~/.aws/credentials`. Here is a quick reference on [how to configure a credential file](https://docs.aws.amazon.com/cli/v1/userguide/cli-configure-files.html) and use [AWS Provider](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#static-credentials).

**Example of ```~/.aws/credentials
``` file :**
**Example of `~/.aws/credentials` file :**

```
[source-account]
Expand Down Expand Up @@ -193,12 +185,9 @@ module "s3_dest_location" {
}
```

By default ```create_role
``` is set to ```false
``` for the destination location as the IAM role is created outside the [DataSync Locations Module](modules/datasync-locations/).
By default `create_role` is set to `false` for the destination location as the IAM role is created outside the [DataSync Locations Module](modules/datasync-locations/).

The ```depends_on
``` meta-argument ensures that terraform creates the destination Datasync location only after the destination account S3 bucket policy is updated to allowing the source account IAM role to transfer data to destination account bucket.
The `depends_on` meta-argument ensures that terraform creates the destination Datasync location only after the destination account S3 bucket policy is updated to allowing the source account IAM role to transfer data to destination account bucket.

**Note:** Task creation would fail if the destination account's S3 bucket policy does not allow the source account's IAM role, as DataSync would verify read/write access to the source and destination S3 buckets before configuring the task.

Expand Down
3 changes: 2 additions & 1 deletion VERSION
Original file line number Diff line number Diff line change
@@ -1 +1,2 @@
v0.0.1
v0.0.2

0 comments on commit 3a217b5

Please sign in to comment.