Demo Setting up S3 for CRR

Welcome back to this lesson. I’m Michael Forrester, and in this guide we will configure cross-region replication (CRR) for our KodeKloud version demo bucket. In this demo, the bucket already has versioning enabled and contains two files.

Step 1: Identify the Source and Target Buckets

Currently, the source bucket is located in Ohio. Duplicate the active browser tab and switch to Virginia. Although Amazon S3 is a global service, our replication target will be the KodeKloud version demo replication bucket.

In Virginia, create a new bucket named KK version demo rep. Enable versioning on this new bucket since replication requires it. After creation, notice that the bucket is set in the U.S. East 1 region.

Step 2: Configure the Replication Rule

Return to the source bucket in Ohio. While settings like versioning, encryption, tiering, and logging are available under the Properties tab, the replication rule must be set up under the Management tab—not under Permissions or Metrics.

1. Under the Management tab, create a new replication rule.
2. Set the rule ID to "one copy to Virginia".
3. Enable the rule with a priority of zero.
4. Define the source bucket as the one in Ohio and specify the newly created replication bucket in Virginia as the destination.
   If the destination bucket does not appear immediately (possibly due to console update latency), manually enter its name.

Step 3: Configure Additional Replication Settings

Proceed with the replication configuration by:

• Entering the destination bucket name (if not auto-populated). The console will validate that the destination is in Virginia.
• Selecting or creating an appropriate IAM role. For simplicity in this demo, we will create a new role for S3 Batch operations.

Before you complete the configuration, adjust the storage class for replicated objects. In this example, the replication rule transitions objects to Glacier after 90 days, balancing cost efficiency with archival retrieval requirements.

For additional settings like replication metrics, delete marker replication, and replica modification sync, the default values are acceptable for this demo. Click Save to create the replication rule.

Step 4: Initiate Batch Operations for Existing Objects

Because the source bucket already contains objects, Amazon S3 will prompt you to run a batch operations job to replicate the existing files. Click Submit to start this one-time copy job.

Creating an IAM Role for S3 Batch Operations

If the batch job fails due to insufficient role permissions, follow these steps to create a suitable IAM role:

1. Open the IAM console and select Create role.
2. Choose S3 as the trusted entity for Batch operations.
3. For the demo, attach administrative access to facilitate cross-boundary replication actions (in a production environment, ensure you apply least privilege).

Use the following JSON as the trust policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "batchoperations.s3.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

After creating the role (for example, name it "S3 Batch Admin"), refresh the batch operations configuration and select the newly created role to recreate the batch job with the corrected settings.

Step 5: Run the Batch Operations Job

Proceed through the batch operations wizard:

1. Verify the manifest settings, permissions, and operation type.
2. Ensure that "Replicate" is selected on the Operation type screen.

Once verified, the job will prepare and await your confirmation before starting the replication process for the existing objects.

After the job runs, review the batch operations job details. Although some nuances may cause minimal failures, the overall process will finish and provide a manifest along with detailed output.

Final Step: Verify Replication

Return to the KodeKloud version demo bucket under the Management tab. You should see that the replication rule is active and replicating objects to the designated bucket in Virginia. This setup successfully demonstrates cross-region replication within the same AWS account. (Note: Cross-account replication can be configured similarly by adjusting the required permissions.)

This completes the setup for S3 cross-region replication in our demo environment.