# Global Data Durability: Implementing Amazon S3 Cross-Region Replication

## **Introduction**

Amazon S3 is a highly durable, scalable object storage service that provides 99.999999999% durability by storing data across multiple Availability Zones. However, certain compliance, latency, and disaster recovery requirements demand storing data across **different AWS Regions**. This is where **Cross-Region Replication (CRR)** comes in.

CRR enables **automatic, asynchronous replication** of objects from one S3 bucket to another in a different AWS Region. It ensures business continuity, improves performance for global users, and helps meet regulatory requirements.

## **Why Use Cross-Region Replication?**

According to AWS best practices and industry use cases:

* **Compliance:** Some regulations require data copies in geographically distant regions.
    
* **Disaster Recovery:** Replicating data across regions mitigates risks from regional outages.
    
* **Latency Optimization:** Serve global customers faster by storing data closer to them.
    
* **Ownership Override:** CRR allows changing object ownership in the destination bucket for access control.
    

## **How CRR Works**

CRR uses **live replication** for new objects and **S3 Batch Replication** for existing objects. Key requirements:

* Both buckets must have **versioning enabled**.
    
* An **IAM role** must grant permissions for replication.
    
* Objects uploaded before enabling replication are not automatically replicated.
    

### **Replication Types:**

* **Same-Region Replication (SRR):** For compliance within a region.
    
* **Cross-Region Replication (CRR):** For multi-region backups and disaster recovery.
    

**Advanced Option:** Enable **Replication Time Control (RTC)** for predictable replication within 15 minutes (additional cost).

## **Step-by-Step Configuration**

### 1\. **Create Buckets and Enable Versioning**

* Create **source bucket** in primary region.
    
* Enable **versioning** via **Properties → Bucket Versioning**.
    
* Create **destination bucket** in secondary region with versioning enabled.
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1767980238623/a37c2451-46bc-41f4-80cc-ef79057fe411.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1767980258400/9fb3e82d-e3cf-4c6f-bdd1-b74638935a33.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1767980353620/88b0efd7-acf0-4cc4-8eb5-6a773f8ad02a.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1767980374203/9dc3c68f-6c1d-4e34-a387-fba34c7e9179.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1767981430052/4ce7103a-8395-442e-a93b-56d1cb83d8da.png align="center")

### **2\. Configure Replication Rule (source bucket)**

* Navigate to **Management → Replication rules → Create replication rule**.
    
* Scope: **Entire bucket** or filtered by **prefix/tags**.
    
* Destination: Select destination bucket.
    
* IAM Role: Assign or create a role with permissions:
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1767981518070/d5f275a1-e190-433f-a6d0-a8aea9cb5c2b.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1767981933251/b65ccbdf-465a-461b-b452-d043bb418302.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1767982008658/fca3994e-4804-48ab-ad80-701d82fb025a.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1767982686966/335f4aff-316e-4310-8e0f-ae2e02ac1bf2.png align="center")

**IAM Replication Policy**

```json
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetReplicationConfiguration",
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::source-br"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetObjectVersionForReplication",
                "s3:GetObjectVersionAcl",
                "s3:GetObjectVersionTagging"
            ],
            "Resource": [
                "arn:aws:s3:::source-br/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:ReplicateObject",
                "s3:ReplicateDelete",
                "s3:ReplicateTags"
            ],
            "Resource": "arn:aws:s3:::target-br/*"
        }
    ]
}
```

There is an advance option for S3 objects to be replicated within 15 minutes, you’ll need to tick the “Replication Time Control (RTC)” box. Please note that this feature incurs additional charges.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1767983081290/7f937ae2-8ab8-4d48-8d44-08a17190af57.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1767983157985/8fb885e5-e2cd-4a7f-8505-24bce7c423ee.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1767983263567/531b2a65-44c6-4454-8487-71ed2447ee00.png align="center")

### **3\. Test Replication**

* Upload a new file to the source bucket.
    
* Verify replication in the destination bucket.
    
* Note: Existing objects require **S3 Batch Replication**.
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1767983734669/abe5c451-75e5-4d50-8db3-38c8e65e7b36.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1767983830092/db875e02-e14c-4ceb-9c86-24dda6468f60.png align="center")

Now validate if the uploaded files are replicated to our target bucket.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1767983859718/67248084-5bdd-4ae9-b8e6-074c2c9f04ab.png align="center")

## **Advanced Scenarios**

### **Encrypted Objects**

* By default, KMS-encrypted objects are not replicated.
    
* Edit replication rule → Enable **Replicate objects encrypted with AWS KMS**.
    
* Specify destination KMS key.
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1767984288819/c06400e2-910d-4f5a-bb57-f439b780079d.png align="center")

### **Folder-Based Replication**

* Use **prefix filter** (e.g., crr-test/) to replicate only specific folders.
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1767984436680/cdeb8cb1-1c01-40ef-af81-fd5435150f7a.png align="center")

### **Tag-Based Replication**

* Create rule with **Tag filter** (e.g., Key=replicate, Value=yes).
    
* Only tagged objects replicate.
    

### **Delete Marker Replication**

* By default, deletions are not replicated.
    
* Enable **Delete marker replication** if required.
    

## **Best Practices & Considerations**

* **Cost:** Replication incurs storage and request charges in both regions.
    
* **Monitoring:** Use **Amazon S3 Replication metrics**, **CloudWatch**, and **EventBridge** for alerts.
    
* **Multi-Region Access Points:** Combine CRR with Multi-Region Access Points for global applications.
    
* **Security:** Apply least-privilege IAM roles and enable encryption for compliance.
    

## **Conclusion**

Amazon S3 CRR is a powerful feature for compliance, disaster recovery, and performance optimization. By leveraging versioning, replication rules, and advanced filters, you can design robust multi-region backup strategies.

### Reference

1. [Replicating objects within and across Regions](https://docs.aws.amazon.com/AmazonS3/latest/userguide/replication.html)
    
2. [Setting up permissions for live replication](https://docs.aws.amazon.com/AmazonS3/latest/userguide/setting-repl-config-perm-overview.html)
    
3. [Replicating existing objects with Batch Replication](https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-batch-replication-batch.html)
    
4. [Using S3 Replication metrics](https://docs.aws.amazon.com/AmazonS3/latest/userguide/repl-metrics.html)