S3バッチオペレーションを使ってクロスアカウントのS3バケット間コピーをやってみた

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowAccountAToPutInventoryReport",
            "Effect": "Allow",
            "Principal": {
                "Service": "s3.amazonaws.com"
            },
            "Action": "s3:PutObject",
            "Resource": "arn:aws:s3:::cm-suto-s3-reports/*",
            "Condition": {
                "StringEquals": {
                    "aws:SourceAccount": "アカウントAのAWS ID",
                    "s3:x-amz-acl": "bucket-owner-full-control"
                },
                "ArnLike": {
                    "aws:SourceArn": "arn:aws:s3:::cm-suto-data-bucket"
                }
            }
        }
    ]
}

import boto3
import urllib.parse
import re
import logging
import os

s3 = boto3.client('s3')
logger = logging.getLogger()
logger.setLevel(logging.INFO)

# コピー先のバケット名は環境変数から取得
DESTINATION_BUCKET = os.environ['DESTINATION_BUCKET']

def lambda_handler(event, context):
    invocation_id = event['invocationId']
    invocation_schema_version = event['invocationSchemaVersion']
    results = []
    task = event['tasks'][0]
    task_id = task['taskId']

    # ★★★ デバッグ用：taskオブジェクトの全体像をログに出力します ★★★
    # logger.info(f"Received task object: {task}")
    # 念のための初期化
    source_key = "unknown" 

    try:
        source_bucket = task['s3Bucket'].split(':')[-1]
        source_key = urllib.parse.unquote_plus(task['s3Key'])

        # .csvファイルであり、かつ日付パターンを持つファイルのみを処理対象とする
        if not source_key.lower().endswith('.csv'):
            result_string = f"Skipped: File is not a .csv file."
            logger.info(f"{result_string} ({source_key})")

        else:
            match = re.search(r'(\d{4}-\d{2}-\d{2})', source_key)
            if not match:
                result_string = f"Skipped: Date pattern 'YYYY-MM-DD' not found in filename."
                logger.info(f"{result_string} ({source_key})")

            else:
                # 条件に一致した場合のみ、コピー処理を実行
                logger.info(f"Processing object: s3://{source_bucket}/{source_key}")

                date_str = match.group(1)
                year, month, day = date_str.split('-')
                file_name = source_key.split('/')[-1]

                destination_key = f"{year}/{month}/{day}/{file_name}"

                s3.copy_object(
                    Bucket=DESTINATION_BUCKET,
                    Key=destination_key,
                    CopySource={'Bucket': source_bucket, 'Key': source_key}
                )

                result_string = f"Successfully copied to s3://{DESTINATION_BUCKET}/{destination_key}"

        results.append({
            'taskId': task_id,
            'resultCode': 'Succeeded',
            'resultString': result_string
        })

    except Exception as e:
        logger.error(f"Error processing task {task_id} for source_key '{source_key}': {e}")
        results.append({
            'taskId': task_id,
            'resultCode': 'PermanentFailure',
            'resultString': str(e)
        })

    return {
        'invocationSchemaVersion': invocation_schema_version,
        'treatMissingKeysAs': 'PermanentFailure',
        'invocationId': invocation_id,
        'results': results
    }

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowReadFromSourceBucket",
            "Effect": "Allow",
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::cm-suto-data-bucket/*"
        },
        {
            "Sid": "AllowWriteToDestinationBucket",
            "Effect": "Allow",
            "Action": "s3:PutObject",
            "Resource": "arn:aws:s3:::cm-suto-sample/*"
        }
    ]
}

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowReadManifestAndWriteReport",
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:GetObjectVersion",
                "s3:PutObject"
            ],
            "Resource": "arn:aws:s3:::cm-suto-s3-reports/*"
        },
        {
            "Sid": "AllowLambdaInvocation",
            "Effect": "Allow",
            "Action": "lambda:InvokeFunction",
            "Resource": "アカウントBのLambda関数用IAMロールのarn"
        }
    ]
}

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "アカウントBのLambda関数用IAMロールのarn"
            },
            "Action": [
                "s3:GetObject",
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::cm-suto-data-bucket",
                "arn:aws:s3:::cm-suto-data-bucket/*"
            ]
        }
    ]
}