Copy between S3 accounts

When copying between S3 locations, S3Client can ask the service to copy data on the server or transfer it through your computer. In the latter case, it reads through the source account and writes through the destination account, using your connection and computer resources.

Check permissions and properties#

The source must be readable and the destination writable. Copying a folder also requires listing its contents. Tags, explicit ACLs and KMS keys can require additional permissions. Archived objects must be available for reading. Moving also requires source deletion.

For a direct copy between accounts, the account signing the request must be able to read the source and write the destination. Having those permissions separately through two accounts enables a relay but does not guarantee a direct copy. Capabilities and configured domains grant no permissions.

An ordinary copy preserves metadata and initially uses Reuse source settings for encryption, but applies the destination default storage class and ACL. Check transfer options, particularly when a KMS key cannot be reused in another service or the source uses SSE-C.

Configure direct copying#

A shared copy domain must identify accounts that access the same server-side buckets. If two independent services share this identifier, a copy may use a different object with the same key.

1. Open File > Accounts....
2. Select the source account and click Edit....
3. In Account, locate Direct copies between accounts.
4. Enable Allow direct copies with other accounts only if the service supports these copies.
5. Enter the same Server-side copy domain identifier in accounts that genuinely share a server-side bucket namespace.
6. In Regions, edit the relevant region if it needs a different domain. A non-empty regional Server-side copy domain overrides the account value; an empty field inherits it.
7. Click OK in the region dialog, then in the account dialog.
8. Repeat the settings for the destination account.

If no effective domain is configured, it remains account-specific and cannot establish a shared domain between two accounts. Within one account, the cross-account checkbox is unnecessary, but both locations must have compatible effective domains.

In Edit... > Capabilities, also check Multipart upload and Multipart server-side copy when the service supports UploadPartCopy. Enable only supported capabilities. Encryption, ACL and storage policies must allow the required requests; multipart settings influence their selection.

Understand the copy method#

If permissions prevent a server-side copy using one account, S3Client may try the other account, then transfer the data through your computer. This relay requires permission to read the source and write to the destination. Some errors stop the copy without a relay.

Start and verify the copy#

An error or interruption leaves completed copies at the destination. A write can also succeed before its verification fails. In Move mode, S3Client keeps the source in that case; if source deletion fails after a successful transfer, both copies may remain. Check both locations before retrying. See the consequences of moving.

1. Open the S3 source in one pane and the S3 destination in the other, under the intended accounts.
2. Select source files or folders and choose Edit > Copy.
3. Activate the destination folder and choose Edit > Paste with options....
4. Check Source, Destination, Copy, the storage class, ACL and the Destination encryption summary. To change encryption, click Change encryption…, choose New encryption: and its settings, then click Use settings. Supply the source key separately through Source decryption > SSE-C read key… if needed.
5. Click Copy and respond to conflict prompts.
6. Wait for completion, then check destination keys and properties.

To identify the actual path, select the completed operation and choose Show details if a log is available. CopyObject or UploadPartCopy requests indicate server-side copying; source reads and destination uploads indicate a relay. Enable logging before the operation if needed; see operation monitoring.