title: AWS Datasync S3 -> S3 cross account, confused about destination role/account
body: <p>I want to use Datasync to copy data from a single S3 bucket in one account to a single S3 bucket in another account. I'm following this official AWS Datasync blog: <a href="https://aws.amazon.com/blogs/storage/how-to-use-aws-datasync-to-migrate-data-between-amazon-s3-buckets/" rel="noreferrer">https://aws.amazon.com/blogs/storage/how-to-use-aws-datasync-to-migrate-data-between-amazon-s3-buckets/</a> in the second section &quot;Copying objects across accounts&quot;.</p>
  <p>I've set up the source and destination buckets, and done the initial steps to &quot;Create a new IAM role and attach a new IAM policy for the source S3 bucket location&quot; and &quot;Add the following trust relationship to the IAM role&quot; (you can see where I mean in the blog by searching for those strings in quotes) but I'm now confused about which account to use to &quot;Open the source S3 bucket policy and apply the following policy to grant permissions for the IAM role to access the objects&quot; and which account to use to run the AWS CLI command &quot;aws sts get-caller-identity&quot; and then the &quot;aws datasync create-location-s3&quot; command straight after that. Am I doing those on the source or destination accounts? The blog is a bit confusing and unclear on those specific steps and I can't find a simpler guide anywhere.</p>