move-bucket.sh

#!/bin/bash -x

set -euo pipefail

bucket=${1:-}
srcAccount=${2:-}
dstAccount=${3:-}

die() {
	echo $* 1>&2
	exit 1
}

if [[ -z "$bucket" || -z "$srcAccount" || -z "$dstAccount" ]]; then
	die "usage: move-bucket <bucket> <src aws profile> <dst aws profile>"
fi

dstArn=$(aws --profile "$dstAccount" iam get-user | jq -r .User.Arn)

policyFile=$(mktemp /tmp/XXXXXX)

cat > $policyFile <<EOF
{
	"Version": "2012-10-17",
	"Statement": [{
		"Sid": "AllowAll",
		"Effect": "Allow",
		"Principal": {
			"AWS": ["${dstArn}"]
		},
		"Action": [
			"s3:*"
		],
		"Resource": [
			"arn:aws:s3:::${bucket}",
			"arn:aws:s3:::${bucket}/*"
		]
	}]
}
EOF

mv ${policyFile}{,.json}

aws --profile "$srcAccount" s3api put-bucket-policy --bucket $bucket --policy file://${policyFile}.json
aws --profile "$dstAccount" s3 mb s3://${bucket}-tmp
aws --profile "$dstAccount" s3 cp --recursive --acl public-read s3://${bucket} s3://${bucket}-tmp
aws --profile "$srcAccount" s3 rb --force s3://${bucket}

# the following operation can take up to 1 hour
while ! aws --profile "$dstAccount" s3 mb s3://${bucket}; do sleep 5; done

aws --profile "$dstAccount" s3 cp --recursive --acl public-read s3://${bucket}-tmp s3://${bucket}
aws --profile "$dstAccount" s3 rb --force s3://${bucket}-tmp