Troubleshooting S3 Cross-Account Replication with SSE-S3
A company is implementing Cross-Region Replication (CRR) for the company’s Amazon S3 buckets. The S3 buckets are in the us-east-1 Region. The company uses server-side encryption with Amazon S3 managed keys (SSE-S3) to secure the data in the buckets. A CloudOps engineer creates a new AWS account to store backups in S3 buckets. All backup buckets are in the us-west-2 Region. The CloudOps engineer enables versioning on the source buckets and the destination buckets. The CloudOps engineer creates an IAM role in the source account for s3.amazonaws.com. The CloudOps engineer grants the IAM role permissions to perform read actions in the source buckets, replicate actions in the destination buckets, and encrypt actions that use the destination bucket's key. The destination bucket policy allows the IAM role to perform replicate and read actions. After the replication configuration is complete, the CloudOps engineer notices that objects are not replicating. What is the likely reason the objects are not replicating?
Community Insight
The question tests knowledge of S3 replication ownership permissions; the common trap is assuming encryption keys must be upgraded to KMS for cross-account access.
This page explains why Amazon S3 Cross-Region Replication fails for cross-account scenarios using SSE-S3 encryption and identifies the required IAM permission.
Many learners incorrectly select Option D, believing that SSE-KMS is mandatory for cross-account replication because AWS managed keys (SSE-S3) cannot encrypt data in a different account.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The correct answer is A. When replicating objects across accounts, the destination bucket policy and the source IAM role must explicitly grant thes3:ObjectOwnerOverrideToBucketOwner permission. Without this permission, the replication process fails because the destination account cannot take ownership of the replicated objects, which are initially owned by the source account. This permission allows the destination bucket owner to assume ownership upon replication, ensuring proper access control and storage billing.Why the Other Options Are Wrong
Option B is incorrect because multi-Region keys are not required for basic replication; standard KMS keys or SSE-S3 can handle replication if permissions are set correctly. Option C is incorrect because VPC endpoints are used for network connectivity within a VPC and are not a requirement for S3 replication, which operates over the public internet or private links but does not mandate VPC endpoints for the replication mechanism itself. Option D is incorrect because while SSE-KMS offers more granular control, it is not strictly required for cross-account replication; SSE-S3 works perfectly fine provided the ownership override permission is granted.Community Comment Notes
Community comments reflect a split in understanding. Some users like Bad_Mat and VanHelwig correctly identify that the missing piece is the ownership override permission, noting that SSE-S3 is already mentioned and sufficient. However, other users like kvf argue for Option D, citing documentation about KMS keys. It is important to note that while KMS keys have specific requirements for cross-account decryption, SSE-S3 relies on the service managing the key, and the primary failure point here is the lack of ownership transfer permission, not the encryption type itself.Official Reference
Exam Strategy
Always check for ownership permissions when troubleshooting cross-account S3 replication failures. If the error involves access denied during replication, look for s3:ObjectOwnerOverrideToBucketOwner before considering encryption changes.
Frequently Asked Questions
Can I replicate SSE-S3 encrypted objects across accounts?
Yes, you can replicate SSE-S3 encrypted objects across accounts as long as you grant the s3:ObjectOwnerOverrideToBucketOwner permission.
Is SSE-KMS required for cross-account S3 replication?
No, SSE-KMS is not required. You can use SSE-S3, but you must configure the ownership override permission in both the IAM role and bucket policy.
Related Analysis
Practice All SOA-C03 Questions
Access 100 questions with complete answers and detailed explanations.
View Full SOA-C03 Practice Test →