Amazon S3 Access Grants now support listing grants across multiple AWS accounts

Amazon S3 Access Grants Updates

Amazon S3 Access Grants now allows you to discover and list all your grants across multiple AWS accounts with a single API call. This eliminates the need to query each account separately.

By setting the new InstanceScope parameter to ALL in your ListCallerAccessGrants request, S3 Access Grants queries every instance shared with you through AWS Resource Access Manager (AWS RAM) and returns all the grants in one combined response, each identifying the account that owns it. Additionally, when you request credentials with GetDataAccess for an S3 path and set InstanceScope to ALL, S3 Access Grants locates the owning account for you, routes the request to its instance, and returns credentials for the matching grant.

What to do

• Use the new InstanceScope parameter in your API calls to list grants across accounts.
• Set InstanceScope to ALL to get a complete view of your S3 data access.
• Request credentials with GetDataAccess and InstanceScope set to ALL for seamless routing and credential retrieval.

This capability is now available in all AWS Regions where S3 Access Grants is available, at no additional cost. You can use the AWS SDK, API, or CLI to list and access grants across accounts.

Source: AWS release notes

If you need further guidance on AWS, our experts are available at AWS@westloop.io. You may also reach us by submitting the Contact Us form.