Introduction
Amazon S3 is a highly durable, scalable object storage service that provides 99.999999999% durability by storing data across multiple Availability Zones. However, certain compliance, latency, and disaster recovery requirements demand storing data across different AWS Regions. This is where Cross-Region Replication (CRR) comes in.
CRR enables automatic, asynchronous replication of objects from one S3 bucket to another in a different AWS Region. It ensures business continuity, improves performance for global users, and helps meet regulatory requirements.
Why Use Cross-Region Replication?
According to AWS best practices and industry use cases:
Compliance: Some regulations require data copies in geographically distant regions.
Disaster Recovery: Replicating data across regions mitigates risks from regional outages.
Latency Optimization: Serve global customers faster by storing data closer to them.
Ownership Override: CRR allows changing object ownership in the destination bucket for access control.
How CRR Works
CRR uses live replication for new objects and S3 Batch Replication for existing objects. Key requirements:
Both buckets must have versioning enabled.
An IAM role must grant permissions for replication.
Objects uploaded before enabling replication are not automatically replicated.
Replication Types:
Advanced Option: Enable Replication Time Control (RTC) for predictable replication within 15 minutes (additional cost).
Step-by-Step Configuration
1. Create Buckets and Enable Versioning
Create source bucket in primary region.
Enable versioning via Properties → Bucket Versioning.
Create destination bucket in secondary region with versioning enabled.
Navigate to Management → Replication rules → Create replication rule.
Scope: Entire bucket or filtered by prefix/tags.
Destination: Select destination bucket.
IAM Role: Assign or create a role with permissions:
IAM Replication Policy
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"s3:GetReplicationConfiguration",
"s3:ListBucket"
],
"Resource": [
"arn:aws:s3:::source-br"
]
},
{
"Effect": "Allow",
"Action": [
"s3:GetObjectVersionForReplication",
"s3:GetObjectVersionAcl",
"s3:GetObjectVersionTagging"
],
"Resource": [
"arn:aws:s3:::source-br/*"
]
},
{
"Effect": "Allow",
"Action": [
"s3:ReplicateObject",
"s3:ReplicateDelete",
"s3:ReplicateTags"
],
"Resource": "arn:aws:s3:::target-br/*"
}
]
}
There is an advance option for S3 objects to be replicated within 15 minutes, you’ll need to tick the “Replication Time Control (RTC)” box. Please note that this feature incurs additional charges.
3. Test Replication
Upload a new file to the source bucket.
Verify replication in the destination bucket.
Note: Existing objects require S3 Batch Replication.
Now validate if the uploaded files are replicated to our target bucket.
Advanced Scenarios
Encrypted Objects
By default, KMS-encrypted objects are not replicated.
Edit replication rule → Enable Replicate objects encrypted with AWS KMS.
Specify destination KMS key.
Folder-Based Replication
- Use prefix filter (e.g., crr-test/) to replicate only specific folders.
Tag-Based Replication
Create rule with Tag filter (e.g., Key=replicate, Value=yes).
Only tagged objects replicate.
Delete Marker Replication
Best Practices & Considerations
Cost: Replication incurs storage and request charges in both regions.
Monitoring: Use Amazon S3 Replication metrics, CloudWatch, and EventBridge for alerts.
Multi-Region Access Points: Combine CRR with Multi-Region Access Points for global applications.
Security: Apply least-privilege IAM roles and enable encryption for compliance.
Conclusion
Amazon S3 CRR is a powerful feature for compliance, disaster recovery, and performance optimization. By leveraging versioning, replication rules, and advanced filters, you can design robust multi-region backup strategies.
Reference
Replicating objects within and across Regions
Setting up permissions for live replication
Replicating existing objects with Batch Replication
Using S3 Replication metrics
