> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # S3 buckets replication remediation ### Triage and Remediation ### Remediation Below are concise, step‑by‑step instructions to enable S3 bucket replication using the AWS Management Console. *** ### Prerequisites 1. **Source and destination buckets created** * Same or different AWS accounts/regions are allowed (CRR vs SRR). 2. **Versioning enabled on both buckets** * Replication requires versioning on **source and destination**. 3. **Permissions** * You must have permissions to configure replication and create an IAM role for replication. *** ### Step 1: Enable Versioning on Source and Destination Buckets Do this for **both** buckets (source and destination): 1. Sign in to the **AWS Management Console** and open **Amazon S3**. 2. In the left navigation, choose **Buckets**. 3. Click the **bucket name**. 4. Go to the **Properties** tab. 5. Scroll to **Bucket Versioning**. 6. Click **Edit**. 7. Select **Enable**. 8. Click **Save changes**. Repeat for the destination bucket. *** ### Step 2: Open Replication Configuration on the Source Bucket 1. In the S3 console, go to **Buckets**. 2. Click the **source bucket** name. 3. Go to the **Management** tab. 4. Under **Replication rules**, click **Create replication rule** (or **Add rule** if one exists). *** ### Step 3: Define Basic Rule Settings 1. **Rule name**: Enter a descriptive name, e.g., `replicate-to-dr-bucket`. 2. **Status**: Leave as **Enabled**. *** ### Step 4: Choose the Source Objects to Replicate 1. Under **Choose a rule scope**: * **Apply to all objects in the bucket** – to replicate the entire bucket; or * **Limit the scope of this rule using one or more filters** – to use: * **Prefix** (e.g., `logs/` or `backup/`) * **Tags** (key/value pairs) 2. Configure prefixes/tags as needed for your policy requirement. *** ### Step 5: Choose Destination Bucket and Options 1. Under **Destination**, click **Choose a bucket in this account** or **Choose a bucket in another account**. 2. Select or type the **destination bucket**. 3. If cross‑region replication is required, select a bucket in a different region. 4. (Optional) Configure: * **Destination storage class** (e.g., Standard, Standard‑IA, Glacier Instant Retrieval, etc.). * **Change object ownership** (if cross‑account, you typically set **Destination bucket owner** to own the replicated objects). * **Replicate delete markers** and/or **existing objects**: * To replicate deletes: check **Delete marker replication**. * To replicate existing objects: check **Replicate existing objects** (if shown as an option for the rule). *** ### Step 6: Configure Encryption / KMS (If Used) If you use **SSE-KMS** on source or destination: 1. Under encryption settings, confirm: * Which KMS key is used for source objects. * Which KMS key will be used for destination objects. 2. Make sure the KMS key policies allow: * The S3 replication role to use **Decrypt** on source key. * The S3 replication role to use **Encrypt** on destination key. (You may need to separately adjust KMS key policies in the **KMS console**.) *** ### Step 7: IAM Role for Replication 1. In the **IAM role** section: * Choose **Create new role** (recommended) or select an existing role that S3 can use. 2. If you choose **Create new role**: * S3 will propose a role name like `AWSServiceRoleForS3Replication`. * Review the auto‑generated trust and permissions. * Confirm to let S3 create and manage this role. 3. If cross‑account: * Ensure the **destination account bucket policy** allows the **source account’s replication role** to write objects and, if needed, change ownership. *** ### Step 8: Review and Save the Replication Rule 1. Review all settings: * Source bucket and scope. * Destination bucket and region. * Storage class. * Ownership and delete marker options. * Replication of existing objects (if required). 2. Click **Save** (or **Create rule**). *** ### Step 9: Validate Replication 1. Upload a new object (or modify an existing one) in the source bucket under the replicated prefix/tag. 2. After a short delay, check the **destination bucket** for the replicated object. 3. Confirm: * Object appears with the correct key (path). * Storage class and encryption match the configuration. * Object owner is as expected (especially cross‑account). *** That is all you need in the **AWS console** to satisfy “S3 Bucket Replication Should Be Enabled” for the target bucket. Below are the minimal steps to enable S3 bucket replication using the AWS CLI. Assumptions: * Source bucket: `SOURCE_BUCKET` * Destination bucket: `DEST_BUCKET` * Region examples: `us-east-1` (source), `us-west-2` (destination) * You will create a replication IAM role: `s3-replication-role` *** ### 1. Ensure versioning is enabled on both buckets ```bash theme={null} aws s3api put-bucket-versioning \ --bucket SOURCE_BUCKET \ --versioning-configuration Status=Enabled aws s3api put-bucket-versioning \ --bucket DEST_BUCKET \ --versioning-configuration Status=Enabled ``` *** ### 2. Create an IAM role for replication #### 2.1 Create the trust policy (trust-policy.json) ```json theme={null} { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Service": "s3.amazonaws.com" }, "Action": "sts:AssumeRole" } ] } ``` Create the role: ```bash theme={null} aws iam create-role \ --role-name s3-replication-role \ --assume-role-policy-document file://trust-policy.json ``` *** ### 3. Attach permissions to the role #### 3.1 Create the permissions policy (replication-policy.json) Replace `SOURCE_BUCKET` and `DEST_BUCKET` with your names. ```json theme={null} { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowReplicationActionsOnSource", "Effect": "Allow", "Action": [ "s3:GetReplicationConfiguration", "s3:ListBucket" ], "Resource": "arn:aws:s3:::SOURCE_BUCKET" }, { "Sid": "AllowObjectReadsOnSource", "Effect": "Allow", "Action": [ "s3:GetObjectVersion", "s3:GetObjectVersionAcl", "s3:GetObjectVersionTagging" ], "Resource": "arn:aws:s3:::SOURCE_BUCKET/*" }, { "Sid": "AllowReplicationToDestination", "Effect": "Allow", "Action": [ "s3:ReplicateObject", "s3:ReplicateDelete", "s3:ReplicateTags", "s3:GetObjectVersionTagging", "s3:ObjectOwnerOverrideToBucketOwner" ], "Resource": "arn:aws:s3:::DEST_BUCKET/*" } ] } ``` Attach the policy: ```bash theme={null} aws iam put-role-policy \ --role-name s3-replication-role \ --policy-name s3-replication-policy \ --policy-document file://replication-policy.json ``` *** ### 4. Get the IAM role ARN ```bash theme={null} aws iam get-role --role-name s3-replication-role \ --query 'Role.Arn' --output text ``` Save the ARN as `ROLE_ARN`. *** ### 5. Create the replication configuration Create `replication-config.json` (replace `ROLE_ARN`, `DEST_BUCKET`): ```json theme={null} { "Role": "ROLE_ARN", "Rules": [ { "ID": "replicate-all-objects", "Status": "Enabled", "Filter": { "Prefix": "" }, "DeleteMarkerReplication": { "Status": "Enabled" }, "Destination": { "Bucket": "arn:aws:s3:::DEST_BUCKET", "StorageClass": "STANDARD" } } ] } ``` *** ### 6. Apply replication configuration to the source bucket ```bash theme={null} aws s3api put-bucket-replication \ --bucket SOURCE_BUCKET \ --replication-configuration file://replication-config.json ``` *** ### 7. Verify replication configuration ```bash theme={null} aws s3api get-bucket-replication \ --bucket SOURCE_BUCKET ``` You should now see the replication rule; new objects in `SOURCE_BUCKET` will replicate to `DEST_BUCKET`. To enable S3 bucket replication with Python (boto3), you need to: 1. Ensure prerequisites 2. Create an IAM role for replication 3. Enable versioning on source and destination buckets 4. Configure replication on the source bucket with Python Below is a concise end‑to‑end guide. *** ## 1. Prerequisites * You have two buckets in the same or different AWS accounts: * Source bucket: e.g., `my-source-bucket` * Destination bucket: e.g., `my-destination-bucket` * You have Python 3 and `boto3` installed: ```bash theme={null} pip install boto3 ``` * Your AWS credentials allow: * `s3:PutBucketReplication`, `s3:GetBucketReplication`, `s3:PutBucketVersioning` * `iam:CreateRole`, `iam:PutRolePolicy` (if you create replication role via Python) *** ## 2. Create the IAM Role for Replication S3 replication uses an IAM role that S3 assumes. You can create this role via the console or via Python. Below is a Python example. ### 2.1 Define trust policy and role policy ```python theme={null} import json import boto3 iam = boto3.client('iam') replication_role_name = "S3ReplicationRole" trust_policy = { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": {"Service": "s3.amazonaws.com"}, "Action": "sts:AssumeRole" } ] } role = iam.create_role( RoleName=replication_role_name, AssumeRolePolicyDocument=json.dumps(trust_policy), Description="Role for S3 cross-bucket replication" ) role_arn = role['Role']['Arn'] print("Created role:", role_arn) ``` Attach an inline policy that allows replication operations: ```python theme={null} source_bucket = "my-source-bucket" destination_bucket = "my-destination-bucket" destination_account_id = "123456789012" # AWS account of destination bucket replication_policy = { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:GetReplicationConfiguration", "s3:ListBucket", "s3:GetObjectVersion", "s3:GetObjectVersionAcl", "s3:GetObjectVersionTagging" ], "Resource": [ f"arn:aws:s3:::{source_bucket}", f"arn:aws:s3:::{source_bucket}/*" ] }, { "Effect": "Allow", "Action": [ "s3:ReplicateObject", "s3:ReplicateDelete", "s3:ReplicateTags", "s3:GetObjectVersionTagging", "s3:PutObjectAcl", "s3:PutObjectVersionAcl", "s3:PutObjectTagging", "s3:PutObjectVersionTagging" ], "Resource": [ f"arn:aws:s3:::{destination_bucket}/*" ] } ] } iam.put_role_policy( RoleName=replication_role_name, PolicyName="S3ReplicationPolicy", PolicyDocument=json.dumps(replication_policy) ) print("Attached replication policy to role.") ``` If source and destination are in different accounts, also ensure the destination bucket policy allows the role to write objects (can be done via console or `put_bucket_policy`). *** ## 3. Enable Versioning on Both Buckets Replication requires versioning. ```python theme={null} import boto3 s3 = boto3.client('s3') def enable_versioning(bucket_name): s3.put_bucket_versioning( Bucket=bucket_name, VersioningConfiguration={"Status": "Enabled"} ) print(f"Versioning enabled on {bucket_name}") enable_versioning(source_bucket) enable_versioning(destination_bucket) ``` *** ## 4. Configure Replication on the Source Bucket Now apply the replication configuration with Python. ```python theme={null} replication_config = { "Role": role_arn, "Rules": [ { "ID": "replicate-all-objects", "Priority": 1, "Status": "Enabled", "DeleteMarkerReplication": {"Status": "Enabled"}, "Filter": {"Prefix": ""}, # empty = all objects "Destination": { "Bucket": f"arn:aws:s3:::{destination_bucket}", # Optional: enable replica ownership override for different accounts # "AccessControlTranslation": {"Owner": "Destination"}, # Optional: change storage class for replicas # "StorageClass": "STANDARD_IA", "Account": destination_account_id # required if different account } } ] } s3.put_bucket_replication( Bucket=source_bucket, ReplicationConfiguration=replication_config ) print("Replication configuration set on source bucket.") ``` *** ## 5. Verify Replication ```python theme={null} response = s3.get_bucket_replication(Bucket=source_bucket) print(response["ReplicationConfiguration"]) ``` Upload a new object to the source bucket and confirm it appears in the destination bucket after a short delay. *** This is the minimal Python/boto3 flow to remediate “S3 Bucket Replication Should Be Enabled” by turning on replication from a source bucket to a destination bucket. ```hcl theme={null} # Existing source bucket resource "aws_s3_bucket" "source" { bucket = "SOURCE_BUCKET_NAME" # replace with your source bucket name } # Existing destination bucket (must be in same or different region/account as needed) resource "aws_s3_bucket" "destination" { bucket = "DESTINATION_BUCKET_NAME" # replace with your destination bucket name } # IAM role used by S3 for replication resource "aws_iam_role" "s3_replication_role" { name = "S3ReplicationRole-FRIENDLY_NAME" # replace FRIENDLY_NAME assume_role_policy = jsonencode({ Version = "2012-10-17" Statement = [ { Effect = "Allow" Principal = { Service = "s3.amazonaws.com" } Action = "sts:AssumeRole" } ] }) } # IAM policy granting S3 permission to replicate from source to destination resource "aws_iam_role_policy" "s3_replication_policy" { name = "S3ReplicationPolicy-FRIENDLY_NAME" # replace FRIENDLY_NAME role = aws_iam_role.s3_replication_role.id policy = jsonencode({ Version = "2012-10-17" Statement = [ { Sid = "ReplicateObjects" Effect = "Allow" Action = [ "s3:GetReplicationConfiguration", "s3:ListBucket" ] Resource = aws_s3_bucket.source.arn }, { Sid = "ReadSourceObjects" Effect = "Allow" Action = [ "s3:GetObjectVersion", "s3:GetObjectVersionAcl", "s3:GetObjectVersionTagging" ] Resource = "${aws_s3_bucket.source.arn}/*" }, { Sid = "WriteReplicaObjects" Effect = "Allow" Action = [ "s3:ReplicateObject", "s3:ReplicateDelete", "s3:ReplicateTags", "s3:PutObjectAcl", "s3:PutObjectTagging" ] Resource = "${aws_s3_bucket.destination.arn}/*" } ] }) } # Bucket versioning is required for replication on both source and destination resource "aws_s3_bucket_versioning" "source" { bucket = aws_s3_bucket.source.id versioning_configuration { status = "Enabled" } } resource "aws_s3_bucket_versioning" "destination" { bucket = aws_s3_bucket.destination.id versioning_configuration { status = "Enabled" } } # Replication configuration on the source bucket resource "aws_s3_bucket_replication_configuration" "source" { bucket = aws_s3_bucket.source.id role = aws_iam_role.s3_replication_role.arn rule { id = "replicate-all-objects" status = "Enabled" delete_marker_replication { status = "Enabled" } filter { prefix = "" # empty = all objects; change if you want to scope } destination { bucket = aws_s3_bucket.destination.arn storage_class = "STANDARD" # optional; change if you need another class } } depends_on = [ aws_iam_role_policy.s3_replication_policy, aws_s3_bucket_versioning.source, aws_s3_bucket_versioning.destination, ] } ``` Enabling or changing replication on an existing bucket does not force bucket replacement, but it can start copying data and incur storage/transfer costs. To verify, `terraform plan` should show creation of `aws_s3_bucket_replication_configuration.source` (and any required IAM and versioning resources) with the rule `status = "Enabled"` attached to the source bucket.