s3.copy with SourceClient not working if we use different account .

self.source_session = boto3.session.Session ( profile_name='account1' )
self.source_conn = self.source_session.resource('s3')
self.src_conn = self.source_session.client('s3')
self.dest_session = boto3.session.Session ( profile_name='account2' )
self.dest_conn = self.dest_session.client ( 's3' )

k = self.source_conn.Object(srcBucketName, key_name)
print 'copy: ' + k.key
copy_source = { 'Bucket': srcBucketName , 'Key': k.key }
self.dest_conn.copy ( copy_source, dstBucketName , k.key, SourceClient = self.src_con)

Error - ClientError: An error occurred (AccessDenied) when calling the CopyObject operation: Access Denied

[john-aws]

The documentation for SourceClient is quite vague:

The client to be used for operation that may happen at the source object. For example, this client is used for the head_object that determines the size of the copy.

A user might reasonably infer that the SourceClient is used for reading the source object.

After reading issues/1310 (this issue), it seems to me that the official boto3 documentation is deficient and misleading. If the underlying client/session credentials are used to both read the source objects and write the target objects, rather than SourceClient being used for the former, then the documentation would ideally state this very clearly. Would you consider updating the documentation to clarify this?

[d4n13lbc]

This tutorial worked for me https://blog.vizuri.com/how-to-copy/move-objects-from-one-s3-bucket-to-another-between-aws-accounts . I needed a policy in the s3 source bucket and a role-policy in the destination account with both the source and the destination buckets as resources. In other cases the error is more meaningful and related to the needed policies but just a CopyDenied error is a bit confuse