> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # S3 Bucket Replication Should Be Enabled ### More Info: S3 bucket replication (cross-region or same-region) should be enabled. Cross-Region S3 replication can help with minimizing latency, and increasing operational efficiency. ### Risk Level Medium ### Address Security ### Compliance Standards CBP,HIPAA,ISO27001 ### Remediation How to enable S3 bucket replication? #### Using AWS Console 1. Open the AWS Management Console: Sign in to the AWS Management Console using your AWS account credentials. 2. Navigate to the S3 service: Search for "S3" in the AWS Management Console search bar or find it in the services menu. 3. Select the source bucket: Click on the name of the bucket that you want to replicate. (In the Cloudanix Console, navigate to "Misconfig" page and look for Affected Assets for "S3 Bucket Replication Should Be Enabled" Policy.) 4. Enable versioning: If versioning is not already enabled for the source bucket, enable it by selecting the "Properties" tab, scrolling down to the "Versioning" section, and clicking on the "Enable versioning" button. Bucket versioning is required for replication. 5. Click on the "Management" tab: In the bucket properties, click on the "Management" tab. 6. Click on "Replication" and then "Add rule": Under "Management options," click on "Replication" and then click on the "Add rule" button. 7. Configure replication rule: a. Choose the destination: Select the destination bucket where you want to replicate the data. You can choose an existing bucket or create a new one. b. Set the rule name: Provide a unique name for the replication rule. c. Configure replication options: Specify the replication options such as storage class, encryption, and prefix filters. d. Review and save the rule: Review the configuration and click on the "Save" button to save the replication rule. 8. Configure permissions for the destination bucket: Grant the necessary permissions to the destination bucket to allow replication. This includes granting the "s3:ReplicateObject" permission to the bucket policy or the IAM role associated with the destination bucket. 9. Monitor the replication: Once replication is enabled, the source bucket's data will be automatically replicated to the destination bucket. You can monitor the replication progress and status in the S3 console. ### Triage and Remediation ### Remediation Below are concise, step‑by‑step instructions to enable S3 bucket replication using the AWS Management Console. *** ### Prerequisites 1. **Source and destination buckets created** * Same or different AWS accounts/regions are allowed (CRR vs SRR). 2. **Versioning enabled on both buckets** * Replication requires versioning on **source and destination**. 3. **Permissions** * You must have permissions to configure replication and create an IAM role for replication. *** ### Step 1: Enable Versioning on Source and Destination Buckets Do this for **both** buckets (source and destination): 1. Sign in to the **AWS Management Console** and open **Amazon S3**. 2. In the left navigation, choose **Buckets**. 3. Click the **bucket name**. 4. Go to the **Properties** tab. 5. Scroll to **Bucket Versioning**. 6. Click **Edit**. 7. Select **Enable**. 8. Click **Save changes**. Repeat for the destination bucket. *** ### Step 2: Open Replication Configuration on the Source Bucket 1. In the S3 console, go to **Buckets**. 2. Click the **source bucket** name. 3. Go to the **Management** tab. 4. Under **Replication rules**, click **Create replication rule** (or **Add rule** if one exists). *** ### Step 3: Define Basic Rule Settings 1. **Rule name**: Enter a descriptive name, e.g., `replicate-to-dr-bucket`. 2. **Status**: Leave as **Enabled**. *** ### Step 4: Choose the Source Objects to Replicate 1. Under **Choose a rule scope**: * **Apply to all objects in the bucket** – to replicate the entire bucket; or * **Limit the scope of this rule using one or more filters** – to use: * **Prefix** (e.g., `logs/` or `backup/`) * **Tags** (key/value pairs) 2. Configure prefixes/tags as needed for your policy requirement. *** ### Step 5: Choose Destination Bucket and Options 1. Under **Destination**, click **Choose a bucket in this account** or **Choose a bucket in another account**. 2. Select or type the **destination bucket**. 3. If cross‑region replication is required, select a bucket in a different region. 4. (Optional) Configure: * **Destination storage class** (e.g., Standard, Standard‑IA, Glacier Instant Retrieval, etc.). * **Change object ownership** (if cross‑account, you typically set **Destination bucket owner** to own the replicated objects). * **Replicate delete markers** and/or **existing objects**: * To replicate deletes: check **Delete marker replication**. * To replicate existing objects: check **Replicate existing objects** (if shown as an option for the rule). *** ### Step 6: Configure Encryption / KMS (If Used) If you use **SSE-KMS** on source or destination: 1. Under encryption settings, confirm: * Which KMS key is used for source objects. * Which KMS key will be used for destination objects. 2. Make sure the KMS key policies allow: * The S3 replication role to use **Decrypt** on source key. * The S3 replication role to use **Encrypt** on destination key. (You may need to separately adjust KMS key policies in the **KMS console**.) *** ### Step 7: IAM Role for Replication 1. In the **IAM role** section: * Choose **Create new role** (recommended) or select an existing role that S3 can use. 2. If you choose **Create new role**: * S3 will propose a role name like `AWSServiceRoleForS3Replication`. * Review the auto‑generated trust and permissions. * Confirm to let S3 create and manage this role. 3. If cross‑account: * Ensure the **destination account bucket policy** allows the **source account’s replication role** to write objects and, if needed, change ownership. *** ### Step 8: Review and Save the Replication Rule 1. Review all settings: * Source bucket and scope. * Destination bucket and region. * Storage class. * Ownership and delete marker options. * Replication of existing objects (if required). 2. Click **Save** (or **Create rule**). *** ### Step 9: Validate Replication 1. Upload a new object (or modify an existing one) in the source bucket under the replicated prefix/tag. 2. After a short delay, check the **destination bucket** for the replicated object. 3. Confirm: * Object appears with the correct key (path). * Storage class and encryption match the configuration. * Object owner is as expected (especially cross‑account). *** That is all you need in the **AWS console** to satisfy “S3 Bucket Replication Should Be Enabled” for the target bucket. Below are the minimal steps to enable S3 bucket replication using the AWS CLI. Assumptions: * Source bucket: `SOURCE_BUCKET` * Destination bucket: `DEST_BUCKET` * Region examples: `us-east-1` (source), `us-west-2` (destination) * You will create a replication IAM role: `s3-replication-role` *** ### 1. Ensure versioning is enabled on both buckets ```bash theme={null} aws s3api put-bucket-versioning \ --bucket SOURCE_BUCKET \ --versioning-configuration Status=Enabled aws s3api put-bucket-versioning \ --bucket DEST_BUCKET \ --versioning-configuration Status=Enabled ``` *** ### 2. Create an IAM role for replication #### 2.1 Create the trust policy (trust-policy.json) ```json theme={null} { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Service": "s3.amazonaws.com" }, "Action": "sts:AssumeRole" } ] } ``` Create the role: ```bash theme={null} aws iam create-role \ --role-name s3-replication-role \ --assume-role-policy-document file://trust-policy.json ``` *** ### 3. Attach permissions to the role #### 3.1 Create the permissions policy (replication-policy.json) Replace `SOURCE_BUCKET` and `DEST_BUCKET` with your names. ```json theme={null} { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowReplicationActionsOnSource", "Effect": "Allow", "Action": [ "s3:GetReplicationConfiguration", "s3:ListBucket" ], "Resource": "arn:aws:s3:::SOURCE_BUCKET" }, { "Sid": "AllowObjectReadsOnSource", "Effect": "Allow", "Action": [ "s3:GetObjectVersion", "s3:GetObjectVersionAcl", "s3:GetObjectVersionTagging" ], "Resource": "arn:aws:s3:::SOURCE_BUCKET/*" }, { "Sid": "AllowReplicationToDestination", "Effect": "Allow", "Action": [ "s3:ReplicateObject", "s3:ReplicateDelete", "s3:ReplicateTags", "s3:GetObjectVersionTagging", "s3:ObjectOwnerOverrideToBucketOwner" ], "Resource": "arn:aws:s3:::DEST_BUCKET/*" } ] } ``` Attach the policy: ```bash theme={null} aws iam put-role-policy \ --role-name s3-replication-role \ --policy-name s3-replication-policy \ --policy-document file://replication-policy.json ``` *** ### 4. Get the IAM role ARN ```bash theme={null} aws iam get-role --role-name s3-replication-role \ --query 'Role.Arn' --output text ``` Save the ARN as `ROLE_ARN`. *** ### 5. Create the replication configuration Create `replication-config.json` (replace `ROLE_ARN`, `DEST_BUCKET`): ```json theme={null} { "Role": "ROLE_ARN", "Rules": [ { "ID": "replicate-all-objects", "Status": "Enabled", "Filter": { "Prefix": "" }, "DeleteMarkerReplication": { "Status": "Enabled" }, "Destination": { "Bucket": "arn:aws:s3:::DEST_BUCKET", "StorageClass": "STANDARD" } } ] } ``` *** ### 6. Apply replication configuration to the source bucket ```bash theme={null} aws s3api put-bucket-replication \ --bucket SOURCE_BUCKET \ --replication-configuration file://replication-config.json ``` *** ### 7. Verify replication configuration ```bash theme={null} aws s3api get-bucket-replication \ --bucket SOURCE_BUCKET ``` You should now see the replication rule; new objects in `SOURCE_BUCKET` will replicate to `DEST_BUCKET`. To enable S3 bucket replication with Python (boto3), you need to: 1. Ensure prerequisites 2. Create an IAM role for replication 3. Enable versioning on source and destination buckets 4. Configure replication on the source bucket with Python Below is a concise end‑to‑end guide. *** ## 1. Prerequisites * You have two buckets in the same or different AWS accounts: * Source bucket: e.g., `my-source-bucket` * Destination bucket: e.g., `my-destination-bucket` * You have Python 3 and `boto3` installed: ```bash theme={null} pip install boto3 ``` * Your AWS credentials allow: * `s3:PutBucketReplication`, `s3:GetBucketReplication`, `s3:PutBucketVersioning` * `iam:CreateRole`, `iam:PutRolePolicy` (if you create replication role via Python) *** ## 2. Create the IAM Role for Replication S3 replication uses an IAM role that S3 assumes. You can create this role via the console or via Python. Below is a Python example. ### 2.1 Define trust policy and role policy ```python theme={null} import json import boto3 iam = boto3.client('iam') replication_role_name = "S3ReplicationRole" trust_policy = { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": {"Service": "s3.amazonaws.com"}, "Action": "sts:AssumeRole" } ] } role = iam.create_role( RoleName=replication_role_name, AssumeRolePolicyDocument=json.dumps(trust_policy), Description="Role for S3 cross-bucket replication" ) role_arn = role['Role']['Arn'] print("Created role:", role_arn) ``` Attach an inline policy that allows replication operations: ```python theme={null} source_bucket = "my-source-bucket" destination_bucket = "my-destination-bucket" destination_account_id = "123456789012" # AWS account of destination bucket replication_policy = { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:GetReplicationConfiguration", "s3:ListBucket", "s3:GetObjectVersion", "s3:GetObjectVersionAcl", "s3:GetObjectVersionTagging" ], "Resource": [ f"arn:aws:s3:::{source_bucket}", f"arn:aws:s3:::{source_bucket}/*" ] }, { "Effect": "Allow", "Action": [ "s3:ReplicateObject", "s3:ReplicateDelete", "s3:ReplicateTags", "s3:GetObjectVersionTagging", "s3:PutObjectAcl", "s3:PutObjectVersionAcl", "s3:PutObjectTagging", "s3:PutObjectVersionTagging" ], "Resource": [ f"arn:aws:s3:::{destination_bucket}/*" ] } ] } iam.put_role_policy( RoleName=replication_role_name, PolicyName="S3ReplicationPolicy", PolicyDocument=json.dumps(replication_policy) ) print("Attached replication policy to role.") ``` If source and destination are in different accounts, also ensure the destination bucket policy allows the role to write objects (can be done via console or `put_bucket_policy`). *** ## 3. Enable Versioning on Both Buckets Replication requires versioning. ```python theme={null} import boto3 s3 = boto3.client('s3') def enable_versioning(bucket_name): s3.put_bucket_versioning( Bucket=bucket_name, VersioningConfiguration={"Status": "Enabled"} ) print(f"Versioning enabled on {bucket_name}") enable_versioning(source_bucket) enable_versioning(destination_bucket) ``` *** ## 4. Configure Replication on the Source Bucket Now apply the replication configuration with Python. ```python theme={null} replication_config = { "Role": role_arn, "Rules": [ { "ID": "replicate-all-objects", "Priority": 1, "Status": "Enabled", "DeleteMarkerReplication": {"Status": "Enabled"}, "Filter": {"Prefix": ""}, # empty = all objects "Destination": { "Bucket": f"arn:aws:s3:::{destination_bucket}", # Optional: enable replica ownership override for different accounts # "AccessControlTranslation": {"Owner": "Destination"}, # Optional: change storage class for replicas # "StorageClass": "STANDARD_IA", "Account": destination_account_id # required if different account } } ] } s3.put_bucket_replication( Bucket=source_bucket, ReplicationConfiguration=replication_config ) print("Replication configuration set on source bucket.") ``` *** ## 5. Verify Replication ```python theme={null} response = s3.get_bucket_replication(Bucket=source_bucket) print(response["ReplicationConfiguration"]) ``` Upload a new object to the source bucket and confirm it appears in the destination bucket after a short delay. *** This is the minimal Python/boto3 flow to remediate “S3 Bucket Replication Should Be Enabled” by turning on replication from a source bucket to a destination bucket. ```hcl theme={null} # Existing source bucket resource "aws_s3_bucket" "source" { bucket = "SOURCE_BUCKET_NAME" # replace with your source bucket name } # Existing destination bucket (must be in same or different region/account as needed) resource "aws_s3_bucket" "destination" { bucket = "DESTINATION_BUCKET_NAME" # replace with your destination bucket name } # IAM role used by S3 for replication resource "aws_iam_role" "s3_replication_role" { name = "S3ReplicationRole-FRIENDLY_NAME" # replace FRIENDLY_NAME assume_role_policy = jsonencode({ Version = "2012-10-17" Statement = [ { Effect = "Allow" Principal = { Service = "s3.amazonaws.com" } Action = "sts:AssumeRole" } ] }) } # IAM policy granting S3 permission to replicate from source to destination resource "aws_iam_role_policy" "s3_replication_policy" { name = "S3ReplicationPolicy-FRIENDLY_NAME" # replace FRIENDLY_NAME role = aws_iam_role.s3_replication_role.id policy = jsonencode({ Version = "2012-10-17" Statement = [ { Sid = "ReplicateObjects" Effect = "Allow" Action = [ "s3:GetReplicationConfiguration", "s3:ListBucket" ] Resource = aws_s3_bucket.source.arn }, { Sid = "ReadSourceObjects" Effect = "Allow" Action = [ "s3:GetObjectVersion", "s3:GetObjectVersionAcl", "s3:GetObjectVersionTagging" ] Resource = "${aws_s3_bucket.source.arn}/*" }, { Sid = "WriteReplicaObjects" Effect = "Allow" Action = [ "s3:ReplicateObject", "s3:ReplicateDelete", "s3:ReplicateTags", "s3:PutObjectAcl", "s3:PutObjectTagging" ] Resource = "${aws_s3_bucket.destination.arn}/*" } ] }) } # Bucket versioning is required for replication on both source and destination resource "aws_s3_bucket_versioning" "source" { bucket = aws_s3_bucket.source.id versioning_configuration { status = "Enabled" } } resource "aws_s3_bucket_versioning" "destination" { bucket = aws_s3_bucket.destination.id versioning_configuration { status = "Enabled" } } # Replication configuration on the source bucket resource "aws_s3_bucket_replication_configuration" "source" { bucket = aws_s3_bucket.source.id role = aws_iam_role.s3_replication_role.arn rule { id = "replicate-all-objects" status = "Enabled" delete_marker_replication { status = "Enabled" } filter { prefix = "" # empty = all objects; change if you want to scope } destination { bucket = aws_s3_bucket.destination.arn storage_class = "STANDARD" # optional; change if you need another class } } depends_on = [ aws_iam_role_policy.s3_replication_policy, aws_s3_bucket_versioning.source, aws_s3_bucket_versioning.destination, ] } ``` Enabling or changing replication on an existing bucket does not force bucket replacement, but it can start copying data and incur storage/transfer costs. To verify, `terraform plan` should show creation of `aws_s3_bucket_replication_configuration.source` (and any required IAM and versioning resources) with the rule `status = "Enabled"` attached to the source bucket. ### Additional Reading: * \[[https://docs.aws.amazon.com/AmazonS3/latest/userguide/replication.html](https://docs.aws.amazon.com/AmazonS3/latest/userguide/replication.html)]