Replicating encrypted objects (SSE-S3, SSE-KMS, DSSE-KMS, SSE-C)

To replicate server-side encrypted objects (Amazon CLI)

To use the examples in this procedure, replace the user input placeholders with your own information.

1. In this example, you create both the source (amzn-s3-demo-source-bucket) and destination (amzn-s3-demo-destination-bucket) buckets in the same Amazon Web Services account. You also set a credentials profile for the Amazon CLI. This example uses the profile name acctA.

   For information about setting credential profiles and using named profiles, see Configuration and credential file settings in the Amazon Command Line Interface User Guide.

2. Use the following commands to create the amzn-s3-demo-source-bucket bucket and enable versioning on it. The following example commands create the amzn-s3-demo-source-bucket bucket in the US East (N. Virginia) (us-east-1) Region.

   aws s3api create-bucket \
   --bucket amzn-s3-demo-source-bucket \
   --region us-east-1 \
   --profile acctA

   aws s3api put-bucket-versioning \
   --bucket amzn-s3-demo-source-bucket \
   --versioning-configuration Status=Enabled \
   --profile acctA

3. Use the following commands to create the amzn-s3-demo-destination-bucket bucket and enable versioning on it. The following example commands create the amzn-s3-demo-destination-bucket bucket in the US West (Oregon) (us-west-2) Region.

   Note

   To set up a replication configuration when both amzn-s3-demo-source-bucket and amzn-s3-demo-destination-bucket buckets are in the same Amazon Web Services account, you use the same profile. This example uses acctA. To configure replication when the buckets are owned by different Amazon Web Services accounts, you specify different profiles for each.

   aws s3api create-bucket \
   --bucket amzn-s3-demo-destination-bucket \
   --region us-west-2 \
   --create-bucket-configuration LocationConstraint=us-west-2 \
   --profile acctA

   aws s3api put-bucket-versioning \
   --bucket amzn-s3-demo-destination-bucket \
   --versioning-configuration Status=Enabled \
   --profile acctA

4. Next, you create an IAM service role. You will specify this role in the replication configuration that you add to the amzn-s3-demo-source-bucket bucket later. Amazon S3 assumes this role to replicate objects on your behalf. You create an IAM role in two steps:

   • Create a service role.

   • Attach a permissions policy to the role.

   1. To create an IAM service role, do the following:

      1. Copy the following trust policy and save it to a file called s3-role-trust-policy-kmsobj.json in the current directory on your local computer. This policy grants the Amazon S3 service principal permissions to assume the role so that Amazon S3 can perform tasks on your behalf.

         {
            "Version":"2012-10-17",
            "Statement":[
               {
                  "Effect":"Allow",
                  "Principal":{
                     "Service":"s3.amazonaws.com"
                  },
                  "Action":"sts:AssumeRole"
               }
            ]
         }

      2. Use the following command to create the role:

         $ aws iam create-role \
         --role-name replicationRolekmsobj \
         --assume-role-policy-document file://s3-role-trust-policy-kmsobj.json  \
         --profile acctA

   2. Next, you attach a permissions policy to the role. This policy grants permissions for various Amazon S3 bucket and object actions.

      1. Copy the following permissions policy and save it to a file named s3-role-permissions-policykmsobj.json in the current directory on your local computer. You will create an IAM role and attach the policy to it later.

         Important

         In the permissions policy, you specify the Amazon KMS key IDs that will be used for encryption of the amzn-s3-demo-source-bucket and amzn-s3-demo-destination-bucket buckets. You must create two separate KMS keys for the amzn-s3-demo-source-bucket and amzn-s3-demo-destination-bucket buckets. Amazon KMS keys aren't shared outside the Amazon Web Services Region in which they were created.

         {
            "Version":"2012-10-17",
            "Statement":[
               {
                  "Action":[
                     "s3:ListBucket",
                     "s3:GetReplicationConfiguration",
                     "s3:GetObjectVersionForReplication",
                     "s3:GetObjectVersionAcl",
                     "s3:GetObjectVersionTagging"
                  ],
                  "Effect":"Allow",
                  "Resource":[
                     "arn:aws-cn:s3:::amzn-s3-demo-source-bucket",
                     "arn:aws-cn:s3:::amzn-s3-demo-source-bucket/*"
                  ]
               },
               {
                  "Action":[
                     "s3:ReplicateObject",
                     "s3:ReplicateDelete",
                     "s3:ReplicateTags"
                  ],
                  "Effect":"Allow",
                  "Condition":{
                     "StringLikeIfExists":{
                        "s3:x-amz-server-side-encryption":[
                           "aws:kms",
                           "AES256",
                           "aws:kms:dsse"
                        ],
                        "s3:x-amz-server-side-encryption-aws-kms-key-id":[
                           "Amazon KMS key IDs(in ARN format) to use for encrypting object replicas"  
                        ]
                     }
                  },
                  "Resource":"arn:aws-cn:s3:::amzn-s3-demo-destination-bucket/*"
               },
               {
                  "Action":[
                     "kms:Decrypt"
                  ],
                  "Effect":"Allow",
                  "Condition":{
                     "StringLike":{
                        "kms:ViaService":"s3.us-east-1.amazonaws.com",
                        "kms:EncryptionContext:aws:s3:arn":[
                           "arn:aws-cn:s3:::amzn-s3-demo-source-bucket/*"
                        ]
                     }
                  },
                  "Resource":[
                     "Amazon KMS key IDs(in ARN format) used to encrypt source objects." 
                  ]
               },
               {
                  "Action":[
                     "kms:Encrypt"
                  ],
                  "Effect":"Allow",
                  "Condition":{
                     "StringLike":{
                        "kms:ViaService":"s3.us-west-2.amazonaws.com",
                        "kms:EncryptionContext:aws:s3:arn":[
                           "arn:aws-cn:s3:::amzn-s3-demo-destination-bucket/*"
                        ]
                     }
                  },
                  "Resource":[
                     "Amazon KMS key IDs (in ARN format) to use for encrypting object replicas" 
                  ]
               }
            ]
         }

      2. Create a policy and attach it to the role.

         $ aws iam put-role-policy \
         --role-name replicationRolekmsobj \
         --policy-document file://s3-role-permissions-policykmsobj.json \
         --policy-name replicationRolechangeownerPolicy \
         --profile acctA

5. Next, add the following replication configuration to the amzn-s3-demo-source-bucket bucket. It tells Amazon S3 to replicate objects with the Tax/ prefix to the amzn-s3-demo-destination-bucket bucket.

   Important

   In the replication configuration, you specify the IAM role that Amazon S3 can assume. You can do this only if you have the iam:PassRole permission. The profile that you specify in the CLI command must have this permission. For more information, see Granting a user permissions to pass a role to an Amazon Web Services service in the IAM User Guide.

    <ReplicationConfiguration>
     <Role>IAM-Role-ARN</Role>
     <Rule>
       <Priority>1</Priority>
       <DeleteMarkerReplication>
          <Status>Disabled</Status>
       </DeleteMarkerReplication>
       <Filter>
          <Prefix>Tax</Prefix>
       </Filter>
       <Status>Enabled</Status>
       <SourceSelectionCriteria>
         <SseKmsEncryptedObjects>
           <Status>Enabled</Status>
         </SseKmsEncryptedObjects>
       </SourceSelectionCriteria>
       <Destination>
         <Bucket>arn:aws-cn:s3:::amzn-s3-demo-destination-bucket</Bucket>
         <EncryptionConfiguration>
           <ReplicaKmsKeyID>Amazon KMS key IDs to use for encrypting object replicas</ReplicaKmsKeyID>
         </EncryptionConfiguration>
       </Destination>
     </Rule>
   </ReplicationConfiguration>

   To add a replication configuration to the amzn-s3-demo-source-bucket bucket, do the following:

   1. The Amazon CLI requires you to specify the replication configuration as JSON. Save the following JSON in a file (replication.json) in the current directory on your local computer.

      {
         "Role":"IAM-Role-ARN",
         "Rules":[
            {
               "Status":"Enabled",
               "Priority":1,
               "DeleteMarkerReplication":{
                  "Status":"Disabled"
               },
               "Filter":{
                  "Prefix":"Tax"
               },
               "Destination":{
                  "Bucket":"arn:aws-cn:s3:::amzn-s3-demo-destination-bucket",
                  "EncryptionConfiguration":{
                     "ReplicaKmsKeyID":"Amazon KMS key IDs (in ARN format) to use for encrypting object replicas"
                  }
               },
               "SourceSelectionCriteria":{
                  "SseKmsEncryptedObjects":{
                     "Status":"Enabled"
                  }
               }
            }
         ]
      }

   2. Edit the JSON to provide values for the amzn-s3-demo-destination-bucket bucket, Amazon KMS key IDs (in ARN format), and IAM-role-ARN. Save the changes.

   3. Use the following command to add the replication configuration to your amzn-s3-demo-source-bucket bucket. Be sure to provide the amzn-s3-demo-source-bucket bucket name.

      $ aws s3api put-bucket-replication \
      --replication-configuration file://replication.json \
      --bucket amzn-s3-demo-source-bucket \
      --profile acctA

6. Test the configuration to verify that encrypted objects are replicated. In the Amazon S3 console, do the following:

   1. Sign in to the Amazon Web Services Management Console and open the Amazon S3 console at https://console.amazonaws.cn/s3/.

   2. In the amzn-s3-demo-source-bucket bucket, create a folder named Tax.

   3. Add sample objects to the folder. Be sure to choose the encryption option and specify your KMS key to encrypt the objects.

   4. Verify that the amzn-s3-demo-destination-bucket bucket contains the object replicas and that they are encrypted by using the KMS key that you specified in the configuration. For more information, see Getting replication status information.