S3 Cross-Region Replication

Mandatory Requirements:

1. Versioning: Must be enabled on BOTH source and destination buckets
2. IAM Permissions: S3 must have permission to replicate (IAM role)
3. Bucket Ownership: Source bucket owner must have source and destination regions enabled
4. Destination Access: For cross-account, destination bucket policy must allow replication

What Gets Replicated:

• Objects created AFTER replication is enabled
• Object metadata and tags
• Object ACL updates
• S3 Object Lock retention information (if configured)

What Does NOT Get Replicated:

• Objects that existed before replication was enabled (use Batch Replication)
• Objects created with SSE-C (customer-provided keys)
• Objects in the source bucket that are replicas from another replication rule
• Delete markers (unless explicitly enabled)
• Lifecycle actions (deletions via lifecycle rules)

Rule Elements:

• Status: Enabled or Disabled
• Priority: Order of rule evaluation (higher = evaluated first)
• Filter: Optional scope limiting (prefix, tags, or both)
• Destination: Target bucket, storage class, account
• Delete Marker Replication: Enable/disable replication of delete markers
• Replication Time Control: Optional predictable replication SLA
• Replica Modification Sync: Sync metadata changes

Filter Options:

No filter: All objects replicated
Prefix: Objects with specific key prefix (e.g., "logs/")
Tags: Objects with specific tags
Prefix + Tags: Combination of both

Default Behavior:

• Delete markers from S3 DELETE operations CAN be replicated (if enabled)
• Delete markers from lifecycle rules are NEVER replicated
• Permanent deletes (delete specific version) are NEVER replicated

Configuration Versions:

• V1 (Legacy): Delete markers replicated by default
• V2 (Current): Delete markers NOT replicated by default, must explicitly enable

Tag-Based Rules Limitation: If your replication rule uses tag-based filtering, delete marker replication must be disabled.

What is RTC? S3 Replication Time Control provides predictable replication with an SLA:

• 99.99% of objects replicated within 15 minutes
• Backed by AWS Service Level Agreement

Features:

• Replication metrics in CloudWatch
• S3 Event Notifications for replication
• Replication time visibility

Requirements:

• Must enable S3 Replication Metrics
• Additional cost per GB replicated

When to Use:

• Compliance requirements for timely backup
• Business continuity needs
• Real-time data synchronization requirements

Purpose: Replicate existing objects that were created before replication was enabled.

Use Cases:

• Backfill newly created destination bucket
• Retry previously failed replications
• Migrate data across accounts
• Add new buckets to data lake

How It Works:

1. Enable standard replication rule first
2. Generate manifest (S3 can auto-generate or use Inventory report)
3. Create Batch Replication job
4. S3 processes manifest and replicates objects

Requirements:

• Existing replication configuration on source bucket
• Manifest stored in same region as source bucket
• IAM permissions for Batch Operations

Purpose: Keep multiple buckets synchronized in both directions.

Configuration:

1. Create replication rule from Bucket A → Bucket B
2. Create replication rule from Bucket B → Bucket A
3. S3 automatically prevents replication loops

Key Points:

• Both buckets must have versioning enabled
• Each bucket needs its own replication rule
• Replica Modification Sync should be enabled
• S3 identifies replicas to prevent infinite loops

Use Cases:

• Active-active multi-region architectures
• Multi-Region Access Points
• Distributed data processing

What are Multi-Region Access Points? A global endpoint that routes requests to the closest bucket automatically.

Integration with Replication:

• Configure CRR between buckets in Multi-Region Access Point
• Requests automatically route to nearest bucket
• Two-way replication keeps all buckets synchronized

Important Consideration: Without replication, a GET request routed to a bucket without the object returns 404. Enable two-way replication to ensure object availability across all buckets.

Best Practices:

• Enable S3 RTC for predictable replication
• Enable Replica Modification Sync
• Use CloudWatch to monitor replication lag

SSE-S3 (S3 Managed Keys):

• Replicated by default
• No additional configuration needed

SSE-KMS (KMS Managed Keys):

• Must explicitly enable in replication configuration
• Specify destination KMS key
• For cross-region: Use multi-region KMS keys or separate keys per region
• Additional KMS API costs

SSE-C (Customer Provided Keys):

• NOT supported for replication
• Objects encrypted with SSE-C cannot be replicated

Client-Side Encryption:

• Objects replicated as-is (encrypted blobs)
• Destination needs access to decryption keys for reading

Additional Requirements:

1. Destination bucket policy must grant source account permission
2. Optionally change object ownership to destination account

Destination Bucket Policy Example:

{
    "Version": "2012-10-17",
    "Statement": [{
        "Sid": "AllowReplication",
        "Effect": "Allow",
        "Principal": {
            "AWS": "arn:aws:iam::SOURCE_ACCOUNT:role/S3ReplicationRole"
        },
        "Action": [
            "s3:ReplicateObject",
            "s3:ReplicateDelete",
            "s3:ReplicateTags"
        ],
        "Resource": "arn:aws:s3:::destination-bucket/*"
    }]
}

Object Ownership:

• By default, source account owns replicated objects
• Enable "Replica ownership override" to transfer ownership
• Requires additional bucket policy permissions