Troubleshooting S3 Cross-Account Replication with SSE-S3

SOA-C03 By islever Editorial Last updated Oct 19, 2026

Implement backup and restore strategies.

Short answer

A The IAM role and bucket policies must have the s3:ObjectOwnerOverrideToBucketOwner permission to allow the destination account to own replicated objects.

Question

A company is implementing Cross-Region Replication (CRR) for the company’s Amazon S3 buckets. The S3 buckets are in the us-east-1 Region. The company uses server-side encryption with Amazon S3 managed keys (SSE-S3) to secure the data in the buckets.
A CloudOps engineer creates a new AWS account to store backups in S3 buckets. All backup buckets are in the us-west-2 Region. The CloudOps engineer enables versioning on the source buckets and the destination buckets. The CloudOps engineer creates an IAM role in the source account for s3.amazonaws.com. The CloudOps engineer grants the IAM role permissions to perform read actions in the source buckets, replicate actions in the destination buckets, and encrypt actions that use the destination bucket's key. The destination bucket policy allows the IAM role to perform replicate and read actions.
After the replication configuration is complete, the CloudOps engineer notices that objects are not replicating.
What is the likely reason the objects are not replicating?

The IAM role and bucket policies must have the ObjectOwnerOverrideToBucketOwner permission. Correct Answer
The objects in the source buckets and destination buckets must be encrypted by multi-Region keys.
Gateway VPC endpoints for Amazon S3 must be created in the source accounts and the destination account.
The destination buckets must use server-side encryption with AWS KMS keys (SSE-KMS).

Key Takeaways

The question tests knowledge of S3 replication ownership permissions; the common trap is assuming encryption keys must be upgraded to KMS for cross-account access.

This page explains why Amazon S3 Cross-Region Replication fails for cross-account scenarios using SSE-S3 encryption and identifies the required IAM permission.

Common mistake: Many learners incorrectly select Option D, believing that SSE-KMS is mandatory for cross-account replication because AWS managed keys (SSE-S3) cannot encrypt data in a different account.

Expert Analysis

Why the Answer Is Correct

The correct answer is A. When replicating objects across accounts, the destination bucket policy and the source IAM role must explicitly grant the s3:ObjectOwnerOverrideToBucketOwner permission. Without this permission, the replication process fails because the destination account cannot take ownership of the replicated objects, which are initially owned by the source account. This permission allows the destination bucket owner to assume ownership upon replication, ensuring proper access control and storage billing.

Why the Other Options Are Wrong

Option B is incorrect because multi-Region keys are not required for basic replication; standard KMS keys or SSE-S3 can handle replication if permissions are set correctly. Option C is incorrect because VPC endpoints are used for network connectivity within a VPC and are not a requirement for S3 replication, which operates over the public internet or private links but does not mandate VPC endpoints for the replication mechanism itself. Option D is incorrect because while SSE-KMS offers more granular control, it is not strictly required for cross-account replication; SSE-S3 works perfectly fine provided the ownership override permission is granted.

Community Comment Notes

Community comments reflect a split in understanding. Some users like Bad_Mat and VanHelwig correctly identify that the missing piece is the ownership override permission, noting that SSE-S3 is already mentioned and sufficient. However, other users like kvf argue for Option D, citing documentation about KMS keys. It is important to note that while KMS keys have specific requirements for cross-account decryption, SSE-S3 relies on the service managing the key, and the primary failure point here is the lack of ownership transfer permission, not the encryption type itself.

Official Reference

https://docs.aws.amazon.com/AmazonS3/latest/userguide/replication-add-config.html

This link opens the official vendor documentation in a new tab.

Exam Strategy

Always check for ownership permissions when troubleshooting cross-account S3 replication failures. If the error involves access denied during replication, look for s3:ObjectOwnerOverrideToBucketOwner before considering encryption changes.

Frequently Asked Questions

Can I replicate SSE-S3 encrypted objects across accounts?

Yes, you can replicate SSE-S3 encrypted objects across accounts as long as you grant the s3:ObjectOwnerOverrideToBucketOwner permission.

Is SSE-KMS required for cross-account S3 replication?

No, SSE-KMS is not required. You can use SSE-S3, but you must configure the ownership override permission in both the IAM role and bucket policy.

More SOA-C03 FAQ →

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

kvf 👍 3 Answered D

https://docs.aws.amazon.com/AmazonS3/latest/userguide/replication-config-for-kms-objects.html#replications If you need to replicate SSE-KMS data cross-account, then your replication rule must specify a customer managed key from AWS KMS for the destination account. AWS managed keys don't allow cross-account use, and therefore can't be used to perform cross-account replication.
Bad_Mat 👍 3 Answered A

The likely reason the objects are not replicating is A. The IAM role and bucket policies must have the ObjectOwnerOverrideToBucketOwner permission
VanHelwig 👍 2 Answered A

SSE-S3 is mentioned, not SSE-KMS. You need s3:ObjectOwnerOverrideToBucketOwner to allow the destination account to own replicated objects.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Practice All SOA-C03 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SOA-C03 Practice Test →

← Back to SOA-C03 Study Guide