blocks|key|241325|text|您需要为每个对象单独运行该命令。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|241326|您可能可以通过以下方法缩短该过程：|241327|aws+s3+cp+--acl+bucket-owner-full-control+--metadata+Key=Value+--profile+<original_account_profile>+s3://bucket/path+s3://bucket/path|code-block|syntax|javascript|241328|也就是说，可以将文件复制到自己，但使用添加的ACL将权限授予桶所有者。|241329|如果您有子目录，那么添加--recursive.|offset|length|style|CODE|241330|entityMap^0|0|0|0|0|C|B|0^^$0|@$1|2|3|4|5|6|7|S|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|T|8|@]|9|@]|A|$]]|$1|D|3|E|5|F|7|U|8|@]|9|@]|A|$G|H]]|$1|I|3|J|5|6|7|V|8|@]|9|@]|A|$]]|$1|K|3|L|5|6|7|W|8|@$M|X|N|Y|O|P]]|9|@]|A|$]]|$1|Q|3|-4|5|6|7|Z|8|@]|9|@]|A|$]]]|R|$]]

You will need to run the command individually for every object.

You might be able to short-cut the process by using:

<pre><code>aws s3 cp --acl bucket-owner-full-control --metadata Key=Value --profile &lt;original_account_profile&gt; s3://bucket/path s3://bucket/path
</code></pre>

That is, you copy the files to themselves, but with the added ACL that grants permissions to the bucket owner.

If you have sub-directories, then add <code>--recursive</code>.

blocks|key|241348|text|这只能通过使用管道来实现。试着-|type|unstyled|depth|inlineStyleRanges|entityRanges|data|241349|aws+s3+ls+s3://bucket/path/+--recursive+%7C+awk+'{cmd="aws+s3api+put-object-acl+--acl+bucket-owner-full-control+--bucket+bucket+--key+"$4;+system(cmd)}'|code-block|syntax|javascript|241350|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|I|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|J|8|@]|9|@]|A|$E|F]]|$1|G|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|H|$]]

This can be only be achieved with using pipes. Try - 

<pre><code>aws s3 ls s3://bucket/path/ --recursive | awk '{cmd="aws s3api put-object-acl --acl bucket-owner-full-control --bucket bucket --key "$4; system(cmd)}'
</code></pre>

blocks|key|126978|text|使用python递归地设置权限。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|126979|#!/usr/bin/env+python
import+boto3
import+sys

client+=+boto3.client('s3')
BUCKET='enter-bucket-name'

def+process_s3_objects(prefix):
++++"""Get+a+list+of+all+keys+in+an+S3+bucket."""
++++kwargs+=+{'Bucket':+BUCKET,+'Prefix':+prefix}
++++failures+=+[]
++++while_true+=+True
++++while+while_true:
++++++resp+=+client.list_objects_v2(**kwargs)
++++++for+obj+in+resp['Contents']:
++++++++try:
++++++++++++print(obj['Key'])
++++++++++++set_acl(obj['Key'])
++++++++++++kwargs['ContinuationToken']+=+resp['NextContinuationToken']
++++++++except+KeyError:
++++++++++++while_true+=+False
++++++++except+Exception:
++++++++++++failures.append(obj["Key"])
++++++++++++continue

++++print+"failures+:",+failures

def+set_acl(key):
++client.put_object_acl(+++++
++++GrantFullControl="id=%25s"+%25+get_account_canonical_id,
++++Bucket=BUCKET,
++++Key=key
)

def+get_account_canonical_id():
++return+client.list_buckets()["Owner"]["ID"]


process_s3_objects(sys.argv[1])|code-block|syntax|javascript|126980|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|I|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|J|8|@]|9|@]|A|$E|F]]|$1|G|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|H|$]]

use python to set up the permissions recursively

<pre><code>#!/usr/bin/env python
import boto3
import sys

client = boto3.client('s3')
BUCKET='enter-bucket-name'

def process_s3_objects(prefix):
 """Get a list of all keys in an S3 bucket."""
 kwargs = {'Bucket': BUCKET, 'Prefix': prefix}
 failures = []
 while_true = True
 while while_true:
 resp = client.list_objects_v2(**kwargs)
 for obj in resp['Contents']:
 try:
 print(obj['Key'])
 set_acl(obj['Key'])
 kwargs['ContinuationToken'] = resp['NextContinuationToken']
 except KeyError:
 while_true = False
 except Exception:
 failures.append(obj["Key"])
 continue

 print "failures :", failures

def set_acl(key):
 client.put_object_acl( 
 GrantFullControl="id=%s" % get_account_canonical_id,
 Bucket=BUCKET,
 Key=key
)

def get_account_canonical_id():
 return client.list_buckets()["Owner"]["ID"]


process_s3_objects(sys.argv[1])
</code></pre>

blocks|key|1876623|text|这样，python代码的效率更高，否则就会花费更长的时间。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1876624|import+boto3
import+sys

client+=+boto3.client('s3')
BUCKET='mybucket'

def+process_s3_objects(prefix):
++++"""Get+a+list+of+all+keys+in+an+S3+bucket."""
++++kwargs+=+{'Bucket':+BUCKET,+'Prefix':+prefix}
++++failures+=+[]
++++while_true+=+True
++++while+while_true:
++++++resp+=+client.list_objects_v2(**kwargs)
++++++for+obj+in+resp['Contents']:
++++++++try:
++++++++++++set_acl(obj['Key'])
++++++++except+KeyError:
++++++++++++while_true+=+False
++++++++except+Exception:
++++++++++++failures.append(obj["Key"])
++++++++++++continue
++++++kwargs['ContinuationToken']+=+resp['NextContinuationToken']
++++print+("failures+:"%2B+failures)

def+set_acl(key):
++print(key)
++client.put_object_acl(
++++ACL='bucket-owner-full-control',
++++Bucket=BUCKET,
++++Key=key
)

def+get_account_canonical_id():
++return+client.list_buckets()["Owner"]["ID"]


process_s3_objects(sys.argv[1])|code-block|syntax|javascript|1876625|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|I|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|J|8|@]|9|@]|A|$E|F]]|$1|G|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|H|$]]

The python code is more efficient this way, otherwise it takes a lot longer.

<pre><code>import boto3
import sys

client = boto3.client('s3')
BUCKET='mybucket'

def process_s3_objects(prefix):
 """Get a list of all keys in an S3 bucket."""
 kwargs = {'Bucket': BUCKET, 'Prefix': prefix}
 failures = []
 while_true = True
 while while_true:
 resp = client.list_objects_v2(**kwargs)
 for obj in resp['Contents']:
 try:
 set_acl(obj['Key'])
 except KeyError:
 while_true = False
 except Exception:
 failures.append(obj["Key"])
 continue
 kwargs['ContinuationToken'] = resp['NextContinuationToken']
 print ("failures :"+ failures)

def set_acl(key):
 print(key)
 client.put_object_acl(
 ACL='bucket-owner-full-control',
 Bucket=BUCKET,
 Key=key
)

def get_account_canonical_id():
 return client.list_buckets()["Owner"]["ID"]


process_s3_objects(sys.argv[1])
</code></pre>

blocks|key|241439|text|这是我唯一的powershell解决方案。|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|241440|aws+s3+ls+s3://BUCKET/+--recursive+%7C+%25{+"aws+s3api+put-object-acl+--bucket+BUCKET+--key+"%2B$_.ToString().substring(30)%2B"+--acl+bucket-owner-full-control"+}|241441|entityMap^0|6|A|0|0|4A|0^^$0|@$1|2|3|4|5|6|7|J|8|@$9|K|A|L|B|C]]|D|@]|E|$]]|$1|F|3|G|5|6|7|M|8|@$9|N|A|O|B|C]]|D|@]|E|$]]|$1|H|3|-4|5|6|7|P|8|@]|D|@]|E|$]]]|I|$]]

This was my <code>powershell</code> only solution.

<code>aws s3 ls s3://BUCKET/ --recursive | %{ "aws s3api put-object-acl --bucket BUCKET --key "+$_.ToString().substring(30)+" --acl bucket-owner-full-control" }</code>

blocks|key|125937|text|其他答案是可以的，但最快的方法是在选项--metadata-directive+REPLACE中使用--metadata-directive+REPLACE命令，如下所示：|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|125938|aws+s3+cp+--recursive+--acl+bucket-owner-full-control+s3://bucket/folder+s3://bucket/folder+--metadata-directive+REPLACE|code-block|syntax|javascript|125939|这使得速度在50米/秒和80米/秒之间。|125940|来自约翰·R的评论的答案，建议使用“虚拟”选项，比如--storage-class+STANDARD。虽然这样做，但只给我拷贝速度在5米/秒和11兆/秒之间。|125941|尝试这种方法的灵感来自AWS关于这个主题的支持文章：https://aws.amazon.com/premiumsupport/knowledge-center/s3-object-change-anonymous-ownership/|125942|注意:如果您遇到一些对象的“访问拒绝”，这很可能是因为您将AWS+creds用于存储桶拥有的帐户，而需要对复制文件的帐户使用creds。|125943|entityMap|0|LINK|mutability|MUTABLE|url|https://aws.amazon.com/premiumsupport/knowledge-center/s3-object-change-anonymous-ownership/^0|J|S|1E|S|0|0|0|Q|O|0|Q|2K|0|0|0^^$0|@$1|2|3|4|5|6|7|10|8|@$9|11|A|12|B|C]|$9|13|A|14|B|C]]|D|@]|E|$]]|$1|F|3|G|5|H|7|15|8|@]|D|@]|E|$I|J]]|$1|K|3|L|5|6|7|16|8|@]|D|@]|E|$]]|$1|M|3|N|5|6|7|17|8|@$9|18|A|19|B|C]]|D|@]|E|$]]|$1|O|3|P|5|6|7|1A|8|@]|D|@$9|1B|A|1C|1|1D]]|E|$]]|$1|Q|3|R|5|6|7|1E|8|@]|D|@]|E|$]]|$1|S|3|-4|5|6|7|1F|8|@]|D|@]|E|$]]]|T|$U|$5|V|W|X|E|$Y|Z]]]]

The other answers are ok, but the FASTEST way to do this is to use the <code>aws s3 cp</code> command with the option <code>--metadata-directive REPLACE</code>, like this:
<pre><code>aws s3 cp --recursive --acl bucket-owner-full-control s3://bucket/folder s3://bucket/folder --metadata-directive REPLACE
</code></pre>
This gives speeds of between 50Mib/s and 80Mib/s.
The answer from the comments from John R, which suggested to use a 'dummy' option, like <code>--storage-class STANDARD</code>. Whilst this works, only gave me copy speeds between 5Mib/s and 11mb/s.
The inspiration for trying this came from AWS's support article on the subject: <a href="https://aws.amazon.com/premiumsupport/knowledge-center/s3-object-change-anonymous-ownership/" rel="noreferrer">https://aws.amazon.com/premiumsupport/knowledge-center/s3-object-change-anonymous-ownership/</a>
NOTE: If you encounter 'access denied` for some of your objects, this is likely because you are using AWS creds for the bucket owning account, whereas you need to use creds for the account where the files were copied from.

blocks|key|125967|text|我使用这个Linux+oneliner递归地更改ACL：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|125968|aws+s3+ls+s3://bucket+--recursive+%7C+cut+-c+32-+%7C+xargs+-n+1+-d+'\n'+--+aws+s3api+put-object-acl+--acl+public-read+--bucket+bukcet+--key|code-block|syntax|javascript|125969|即使文件名包含()字符，它也能工作。|125970|entityMap^0|0|0|0^^$0|@$1|2|3|4|5|6|7|K|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|L|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|M|8|@]|9|@]|A|$]]|$1|I|3|-4|5|6|7|N|8|@]|9|@]|A|$]]]|J|$]]

I used this Linux Bash shell oneliner to change ACLs recursively:
<pre><code>aws s3 ls s3://bucket --recursive | cut -c 32- | xargs -n 1 -d '\n' -- aws s3api put-object-acl --acl public-read --bucket bukcet --key
</code></pre>
It works even if file names contain () characters.

blocks|key|1876805|text|对于在相当大的桶中获取日志对象的所有权，我也有类似的问题。物体总数-3+290+956总尺寸1.4+TB。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1876806|我找到的解决方案对于这么多的对象来说太慢了。最后，我编写了一些代码，这些代码能够以比|1876807|aws+s3+cp|blockquote|1876808|您需要安装需求：|1876809|pip+install+pathos+boto3+click|code-block|syntax|javascript|1876810|#!/usr/bin/env+python3
import+logging
import+os
import+sys
import+boto3
import+botocore
import+click
from+time+import+time
from+botocore.config+import+Config
from+pathos.pools+import+ThreadPool+as+Pool

logger+=+logging.getLogger(__name__)

streamformater+=+logging.Formatter("[*]+%25(levelname)s:+%25(asctime)s:+%25(message)s")
logstreamhandler+=+logging.StreamHandler()
logstreamhandler.setFormatter(streamformater)


def+_set_log_level(ctx,+param,+value):
++++if+value:
++++++++ctx.ensure_object(dict)
++++++++ctx.obj["log_level"]+=+value
++++++++logger.setLevel(value)
++++++++if+value+<=+20:
++++++++++++logger.info(f"Logger+set+to+{logging.getLevelName(logger.getEffectiveLevel())}")
++++return+value


@click.group(chain=False)
@click.version_option(version='0.1.0')
@click.pass_context
def+cli(ctx):
++++"""
++++++++Take+object+ownership+of+S3+bucket+objects.
++++"""
++++ctx.ensure_object(dict)
++++ctx.obj["aws_config"]+=+Config(
++++++++retries={
++++++++++++'max_attempts':+10,
++++++++++++'mode':+'standard'
++++++++}
++++)


@cli.command("own")
@click.argument("bucket",+type=click.STRING)
@click.argument("prefix",+type=click.STRING,+default="/")
@click.option("--profile",+type=click.STRING,+default="default",+envvar="AWS_DEFAULT_PROFILE",+help="Configuration+profile+from+~/.aws/{credentials,config}")
@click.option("--region",+type=click.STRING,+default="us-east-1",+envvar="AWS_DEFAULT_REGION",+help="AWS+region")
@click.option("--threads",+"-t",+type=click.INT,+default=40,+help="Threads+to+use")
@click.option("--loglevel",+"log_level",+hidden=True,+flag_value=logging.INFO,+callback=_set_log_level,+expose_value=False,+is_eager=True,+default=True)
@click.option("--verbose",+"-v",+"log_level",+flag_value=logging.DEBUG,+callback=_set_log_level,+expose_value=False,+is_eager=True,+help="Increase+log_level")
@click.pass_context
def+command_own(ctx,+*args,+**kwargs):
++++ctx.obj.update(kwargs)
++++profile_name+=+ctx.obj.get("profile")
++++region+=+ctx.obj.get("region")
++++bucket+=+ctx.obj.get("bucket")
++++prefix+=+ctx.obj.get("prefix").lstrip("/")
++++threads+=+ctx.obj.get("threads")
++++pool+=+Pool(nodes=threads)
++++logger.addHandler(logstreamhandler)
++++logger.info(f"Getting+ownership+of+all+objects+in+s3://{bucket}/{prefix}")
++++start+=+time()

++++try:
++++++++SESSION:+boto3.Session+=+boto3.session.Session(profile_name=profile_name)
++++except+botocore.exceptions.ProfileNotFound+as+e:
++++++++logger.warning(f"Profile+{profile_name}+was+not+found.")
++++++++logger.warning(f"Falling+back+to+environment+variables+for+AWS_ACCESS_KEY_ID,+AWS_SECRET_ACCESS_KEY+and+AWS_SESSION_TOKEN")
++++++++AWS_ACCESS_KEY_ID+=+os.environ.get("AWS_ACCESS_KEY_ID",+"")
++++++++AWS_SECRET_ACCESS_KEY+=+os.environ.get("AWS_SECRET_ACCESS_KEY",+"")
++++++++AWS_SESSION_TOKEN+=+os.environ.get("AWS_SESSION_TOKEN",+"")
++++++++if+AWS_ACCESS_KEY_ID+and+AWS_SECRET_ACCESS_KEY:
++++++++++++if+AWS_SESSION_TOKEN:
++++++++++++++++SESSION:+boto3.Session+=+boto3.session.Session(aws_access_key_id=AWS_ACCESS_KEY_ID,+aws_secret_access_key=AWS_SECRET_ACCESS_KEY,
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++aws_session_token=AWS_SESSION_TOKEN)
++++++++++++else:
++++++++++++++++SESSION:+boto3.Session+=+boto3.session.Session(aws_access_key_id=AWS_ACCESS_KEY_ID,+aws_secret_access_key=AWS_SECRET_ACCESS_KEY)
++++++++else:
++++++++++++logger.error("Unable+to+find+AWS+credentials.")
++++++++++++sys.exit(1)

++++s3c+=+SESSION.client('s3',+config=ctx.obj["aws_config"])

++++def+bucket_keys(Bucket,+Prefix='',+StartAfter='',+Delimiter='/'):
++++++++Prefix+=+Prefix[1:]+if+Prefix.startswith(Delimiter)+else+Prefix
++++++++if+not+StartAfter:
++++++++++++del+StartAfter
++++++++++++if+Prefix.endswith(Delimiter):
++++++++++++++++StartAfter+=+Prefix
++++++++del+Delimiter
++++++++for+page+in+s3c.get_paginator('list_objects_v2').paginate(Bucket=Bucket,+Prefix=Prefix):
++++++++++++for+content+in+page.get('Contents',+()):
++++++++++++++++yield+content['Key']

++++def+worker(key):
++++++++logger.info(f"Processing:+{key}")
++++++++s3c.copy_object(Bucket=bucket,+Key=key,
++++++++++++++++++++++++CopySource={'Bucket':+bucket,+'Key':+key},
++++++++++++++++++++++++ACL='bucket-owner-full-control',
++++++++++++++++++++++++StorageClass="STANDARD"
++++++++++++++++++++++++)

++++object_keys+=+bucket_keys(bucket,+prefix)
++++pool.map(worker,+object_keys)
++++end+=+time()
++++logger.info(f"Completed+for+{end+-+start:.2f}+seconds.")


if+__name__+==+'__main__':
++++cli()|1876811|用法：|1876812|get_object_ownership.py+own+-v+my-big-aws-logs-bucket+/prefix|1876813|用40个螺纹对上述桶进行了7个小时的加工。|1876814|*信息:+2021-08-05+19:53:55,542:完成25320.45秒。|1876815|在同一数据子集上使用AWS+cli与此工具进行更快的比较：|1876816|aws+s3+cp+-递归-acl桶所有者-完全控制-元数据-指令53.59s用户7.24s系统20%25+cpu+5:02.42总计|1876817|vs|1876818|*信息:+2021-08-06+09:07:43,506:完成49.09秒。|1876819|entityMap^0|0|0|0|0|0|0|0|0|0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|17|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|18|8|@]|9|@]|A|$]]|$1|D|3|E|5|F|7|19|8|@]|9|@]|A|$]]|$1|G|3|H|5|6|7|1A|8|@]|9|@]|A|$]]|$1|I|3|J|5|K|7|1B|8|@]|9|@]|A|$L|M]]|$1|N|3|O|5|K|7|1C|8|@]|9|@]|A|$L|M]]|$1|P|3|Q|5|6|7|1D|8|@]|9|@]|A|$]]|$1|R|3|S|5|K|7|1E|8|@]|9|@]|A|$L|M]]|$1|T|3|U|5|6|7|1F|8|@]|9|@]|A|$]]|$1|V|3|W|5|F|7|1G|8|@]|9|@]|A|$]]|$1|X|3|Y|5|6|7|1H|8|@]|9|@]|A|$]]|$1|Z|3|10|5|F|7|1I|8|@]|9|@]|A|$]]|$1|11|3|12|5|6|7|1J|8|@]|9|@]|A|$]]|$1|13|3|14|5|F|7|1K|8|@]|9|@]|A|$]]|$1|15|3|-4|5|6|7|1L|8|@]|9|@]|A|$]]]|16|$]]

I had a similar issue with taking ownership of log objects in a quite large bucket.
Total number of objects - 3,290,956 Total size 1.4 TB.
The solutions I was able to find were far too sluggish for that amount of objects. I ended up writing some code that was able to do the job several times faster than
<blockquote>
aws s3 cp
</blockquote>
You will need to install requirements:
<pre><code>pip install pathos boto3 click
</code></pre>
<hr />
<pre><code>#!/usr/bin/env python3
import logging
import os
import sys
import boto3
import botocore
import click
from time import time
from botocore.config import Config
from pathos.pools import ThreadPool as Pool

logger = logging.getLogger(__name__)

streamformater = logging.Formatter(&quot;[*] %(levelname)s: %(asctime)s: %(message)s&quot;)
logstreamhandler = logging.StreamHandler()
logstreamhandler.setFormatter(streamformater)


def _set_log_level(ctx, param, value):
 if value:
 ctx.ensure_object(dict)
 ctx.obj[&quot;log_level&quot;] = value
 logger.setLevel(value)
 if value &lt;= 20:
 logger.info(f&quot;Logger set to {logging.getLevelName(logger.getEffectiveLevel())}&quot;)
 return value


@click.group(chain=False)
@click.version_option(version='0.1.0')
@click.pass_context
def cli(ctx):
 &quot;&quot;&quot;
 Take object ownership of S3 bucket objects.
 &quot;&quot;&quot;
 ctx.ensure_object(dict)
 ctx.obj[&quot;aws_config&quot;] = Config(
 retries={
 'max_attempts': 10,
 'mode': 'standard'
 }
 )


@cli.command(&quot;own&quot;)
@click.argument(&quot;bucket&quot;, type=click.STRING)
@click.argument(&quot;prefix&quot;, type=click.STRING, default=&quot;/&quot;)
@click.option(&quot;--profile&quot;, type=click.STRING, default=&quot;default&quot;, envvar=&quot;AWS_DEFAULT_PROFILE&quot;, help=&quot;Configuration profile from ~/.aws/{credentials,config}&quot;)
@click.option(&quot;--region&quot;, type=click.STRING, default=&quot;us-east-1&quot;, envvar=&quot;AWS_DEFAULT_REGION&quot;, help=&quot;AWS region&quot;)
@click.option(&quot;--threads&quot;, &quot;-t&quot;, type=click.INT, default=40, help=&quot;Threads to use&quot;)
@click.option(&quot;--loglevel&quot;, &quot;log_level&quot;, hidden=True, flag_value=logging.INFO, callback=_set_log_level, expose_value=False, is_eager=True, default=True)
@click.option(&quot;--verbose&quot;, &quot;-v&quot;, &quot;log_level&quot;, flag_value=logging.DEBUG, callback=_set_log_level, expose_value=False, is_eager=True, help=&quot;Increase log_level&quot;)
@click.pass_context
def command_own(ctx, *args, **kwargs):
 ctx.obj.update(kwargs)
 profile_name = ctx.obj.get(&quot;profile&quot;)
 region = ctx.obj.get(&quot;region&quot;)
 bucket = ctx.obj.get(&quot;bucket&quot;)
 prefix = ctx.obj.get(&quot;prefix&quot;).lstrip(&quot;/&quot;)
 threads = ctx.obj.get(&quot;threads&quot;)
 pool = Pool(nodes=threads)
 logger.addHandler(logstreamhandler)
 logger.info(f&quot;Getting ownership of all objects in s3://{bucket}/{prefix}&quot;)
 start = time()

 try:
 SESSION: boto3.Session = boto3.session.Session(profile_name=profile_name)
 except botocore.exceptions.ProfileNotFound as e:
 logger.warning(f&quot;Profile {profile_name} was not found.&quot;)
 logger.warning(f&quot;Falling back to environment variables for AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY and AWS_SESSION_TOKEN&quot;)
 AWS_ACCESS_KEY_ID = os.environ.get(&quot;AWS_ACCESS_KEY_ID&quot;, &quot;&quot;)
 AWS_SECRET_ACCESS_KEY = os.environ.get(&quot;AWS_SECRET_ACCESS_KEY&quot;, &quot;&quot;)
 AWS_SESSION_TOKEN = os.environ.get(&quot;AWS_SESSION_TOKEN&quot;, &quot;&quot;)
 if AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY:
 if AWS_SESSION_TOKEN:
 SESSION: boto3.Session = boto3.session.Session(aws_access_key_id=AWS_ACCESS_KEY_ID, aws_secret_access_key=AWS_SECRET_ACCESS_KEY,
 aws_session_token=AWS_SESSION_TOKEN)
 else:
 SESSION: boto3.Session = boto3.session.Session(aws_access_key_id=AWS_ACCESS_KEY_ID, aws_secret_access_key=AWS_SECRET_ACCESS_KEY)
 else:
 logger.error(&quot;Unable to find AWS credentials.&quot;)
 sys.exit(1)

 s3c = SESSION.client('s3', config=ctx.obj[&quot;aws_config&quot;])

 def bucket_keys(Bucket, Prefix='', StartAfter='', Delimiter='/'):
 Prefix = Prefix[1:] if Prefix.startswith(Delimiter) else Prefix
 if not StartAfter:
 del StartAfter
 if Prefix.endswith(Delimiter):
 StartAfter = Prefix
 del Delimiter
 for page in s3c.get_paginator('list_objects_v2').paginate(Bucket=Bucket, Prefix=Prefix):
 for content in page.get('Contents', ()):
 yield content['Key']

 def worker(key):
 logger.info(f&quot;Processing: {key}&quot;)
 s3c.copy_object(Bucket=bucket, Key=key,
 CopySource={'Bucket': bucket, 'Key': key},
 ACL='bucket-owner-full-control',
 StorageClass=&quot;STANDARD&quot;
 )

 object_keys = bucket_keys(bucket, prefix)
 pool.map(worker, object_keys)
 end = time()
 logger.info(f&quot;Completed for {end - start:.2f} seconds.&quot;)


if __name__ == '__main__':
 cli()
</code></pre>
Usage:
<pre><code>get_object_ownership.py own -v my-big-aws-logs-bucket /prefix
</code></pre>
The bucket mentioned above was processed for ~7 hours using 40 threads.
<blockquote>
[*] INFO: 2021-08-05 19:53:55,542: Completed for 25320.45 seconds.
</blockquote>
Some more speed comparison using AWS cli vs this tool on the same subset of data:
<blockquote>
aws s3 cp --recursive --acl bucket-owner-full-control --metadata-directive
53.59s user 7.24s system 20% cpu 5:02.42 total
</blockquote>
vs
<blockquote>
[*] INFO: 2021-08-06 09:07:43,506: Completed for 49.09 seconds.
</blockquote>

blocks|key|1876884|text|要解决为每个对象设置ACL的需要，您可以做的一件事是禁用存储桶的ACL。桶中的所有对象都将由桶所有者拥有，您可以使用策略来进行访问控制，而不是ACL。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1876885|为此，您可以将“对象所有权”设置设置为“桶所有者强制”。根据AWS文件，这实际上是建议的设置：|offset|length|1876886|对于S3中的大多数现代用例，我们建议您通过选择桶所有者强制设置禁用ACL，并根据需要使用桶策略与帐户外的用户共享数据。这种方法简化了权限管理和审核。|blockquote|1876887|您可以在web控制台中通过转到桶的“权限”选项卡，并单击“对象所有权”部分中的"Edit“按钮来设置这个选项。然后，您可以选择“ACL禁用”单选按钮。|1876888|您也可以使用AWS+CLI。一个来自文献资料的例子|1876889|aws+s3api+put-bucket-ownership-controls+--bucket+DOC-EXAMPLE-BUCKET+--ownership-controls+Rules=[{ObjectOwnership=BucketOwnerEnforced}]|code-block|syntax|javascript|1876890|entityMap|0|LINK|mutability|MUTABLE|url|https://docs.aws.amazon.com/AmazonS3/latest/userguide/about-object-ownership.html|1|https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-ownership-existing-bucket.html^0|0|U|5|0|0|0|0|I|4|1|0|0^^$0|@$1|2|3|4|5|6|7|11|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|12|8|@]|9|@$D|13|E|14|1|15]]|A|$]]|$1|F|3|G|5|H|7|16|8|@]|9|@]|A|$]]|$1|I|3|J|5|6|7|17|8|@]|9|@]|A|$]]|$1|K|3|L|5|6|7|18|8|@]|9|@$D|19|E|1A|1|1B]]|A|$]]|$1|M|3|N|5|O|7|1C|8|@]|9|@]|A|$P|Q]]|$1|R|3|-4|5|6|7|1D|8|@]|9|@]|A|$]]]|S|$T|$5|U|V|W|A|$X|Y]]|Z|$5|U|V|W|A|$X|10]]]]

One thing you can do to get around the need for setting the ACL for every single object is disabling ACLs for the bucket. All objects in the bucket will then be owned by the bucket owner, and you can use policies for access control instead of ACLs.
You do this by setting the &quot;object ownership&quot; setting to &quot;bucket owner enforced&quot;. As per <a href="https://docs.aws.amazon.com/AmazonS3/latest/userguide/about-object-ownership.html" rel="nofollow noreferrer">the AWS documentation</a>, this is in fact the recommended setting:
<blockquote>
For the majority of modern use cases in S3, we recommend that you disable ACLs by choosing the bucket owner enforced setting and use your bucket policy to share data with users outside of your account as needed. This approach simplifies permissions management and auditing.
</blockquote>
You can set this in the web console by going to the &quot;Permissions&quot; tab for the bucket, and clicking the &quot;Edit&quot; button in the &quot;Object Ownership&quot; section. You can then select the &quot;ACLs disabled&quot; radio button.
You can also use the AWS CLI. An example from <a href="https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-ownership-existing-bucket.html" rel="nofollow noreferrer">the documentation</a>:
<pre><code>aws s3api put-bucket-ownership-controls --bucket DOC-EXAMPLE-BUCKET --ownership-controls Rules=[{ObjectOwnership=BucketOwnerEnforced}]
</code></pre>

I am trying to grant permissions to an existing account in s3.

The bucket is owned by the account, but the data was copied from another account's bucket.

When I try to grant permissions with the command:

<pre><code>aws s3api put-object-acl --bucket &lt;bucket_name&gt; --key &lt;folder_name&gt; --profile &lt;original_account_profile&gt; --grant-full-control emailaddress=&lt;destination_account_email&gt;
</code></pre>

I receive the error:

<pre><code>An error occurred (NoSuchKey) when calling the PutObjectAcl operation: The specified key does not exist.
</code></pre>

while if I do it on a single file the command is successful.

How can I make it work for a full folder?

How to change permission recursively to folder with AWS s3 or AWS s3api

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

我正在尝试向s3中的一个现有帐户授予权限。存储桶由帐户拥有，但数据是从另一个帐户的桶中复制的。当我尝试使用命令授予权限时：aws s3api put-object-acl --bucket <bucket_name> --key <folder_name> --profile <original_account_pro...

问如何递归地将权限更改为具有AWS s3或AWS s3api的文件夹
EN

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问如何递归地将权限更改为具有AWS s3或AWS s3api的文件夹EN