Setting up S3 bucket ACL

Guide to storing Export files on Amazon S3 Bucket

When exporting instances from AWS environment to other virtualization environments, storing them on S3 bucket is very important.

Step 1: Create S3 Bucket to store Export files

  • Access Amazon S3 Management Console.

  • In the navigation pane, select Buckets.

  • On the Create bucket page, configure the S3 bucket parameters:

  • In the General configuration section, select bucket type as General purpose, use Global namespace and enter a unique name for the bucket in the Bucket name field.The name must be globally unique. (Example: export-bucket-2026-1a)

    Illustration

Step 2: Configure Block Public Access and Permissions

  1. Uncheck Block all public access to allow public access. AWS will display a warning, you need to select I acknowledge that the current settings might result in this bucket and the objects within becoming public.

    Illustration

    • And select Disable in the Bucket Versioning section. Illustration

  2. In the Default encryption section, select SSE-S3, check Enable for Bucket Key and click Create bucket to complete the initialization process.

    Illustration Illustration

Step 3: Configure Access Control List (ACL)

  1. Select Bucket owner enforced in the Object Ownership section.

    Illustration

  2. On the Edit Object Ownership screen, select ACLs enabled, check the confirmation box to restore ACLs, select Bucket owner preferred and click Save changes.

    Illustration

    • Then select Edit.

    Illustration

  3. Click Add grantee.

    Illustration

  4. Enter Canonical ID and select Write Objects and Read bucket ACL permissions, then click Save changes.

    Illustration

  5. Add Bucket Policy

  • Go to S3 → Bucket → Permissions → Bucket policy → Edit.

  • Paste the following minimum policy (change bucket name and prefix accordingly):


{
  "Version":"2012-10-17",
  "Statement":[
    {
      "Sid":"AllowVmImportExportToWrite",
      "Effect":"Allow",
      "Principal":{"CanonicalUser":"c4d8eabf8db69dbe46bfe0e517100c554f01200b104d59cd408e777ba442a322"},
      "Action":[ "s3:GetBucketAcl", "s3:PutObject" ],
      "Resource":[
        "arn:aws:s3:::export-bucket-2026-1a",
        "arn:aws:s3:::export-bucket-2026-1a/exports/*"
      ]
    }
  ]
}

Illustration

  • Select Save changes.

Illustration

Note: Canonical ID will vary depending on AWS Region. Below is the list of Canonical IDs for user vm-import-export@amazon.com by region.

List of Canonical IDs for user vm-import-export@amazon.com by AWS Region:

Africa (Cape Town)
3f7744aeebaf91dd60ab135eb1cf908700c8d2bc9133e61261e6c582be6e33ee

Asia Pacific (Hong Kong)
97ee7ab57cc9b5034f31e107741a968e595c0d7a19ec23330eae8d045a46edfb

Europe (Milan)
04636d9a349e458b0c1cbf1421858b9788b4ec28b066148d4907bb15c52b5b9c

Middle East (Bahrain)
aa763f2cf70006650562c62a09433f04353db3cba6ba6aeb3550fdc8065d3d9f

China (Beijing)
834bafd86b15b6ca71074df0fd1f93d234b9d5e848a2cb31f880c149003ce36f

AWS GovCloud (US)
af913ca13efe7a94b88392711f6cfc8aa07c9d1454d4f190a624b126733a5602

Other Regions
c4d8eabf8db69dbe46bfe0e517100c554f01200b104d59cd408e777ba442a322