Replicating objects created with server-side encryption (SSE-C, SSE-S3, SSE-KMS)

There are some special considerations when you're replicating objects that have been encrypted by using server-side encryption. Amazon S3 supports the following types of server-side encryption:

For more information about server-side encryption, see Protecting data using server-side encryption.

This topic explains the permissions that you need to direct Amazon S3 to replicate objects that have been encrypted by using server-side encryption. This topic also provides additional configuration elements that you can add and example Amazon Identity and Access Management (IAM) policies that grant the necessary permissions for replicating encrypted objects.

For an example with step-by-step instructions, see Replicating encrypted objects. For information about creating a replication configuration, see Replicating objects.

How default bucket encryption affects replication

When you enable default encryption for a replication destination bucket, the following encryption behavior applies:

Replicating objects encrypted with SSE-C

By using server-side encryption with customer-provided keys (SSE-C), you can manage proprietary encryption keys. With SSE-C, you manage the keys while Amazon S3 manages the encryption and decryption process. You must provide an encryption key as part of your request, but you don't need to write any code to perform object encryption or decryption. When you upload an object, Amazon S3 encrypts the object by using the key that you provided. Amazon S3 then purges that key from memory. When you retrieve an object, you must provide the same encryption key as part of your request. For more information, see Using server-side encryption with customer-provided keys (SSE-C).

S3 Replication supports objects that are encrypted with SSE-C. You can configure SSE-C object replication in the Amazon S3 console or with the Amazon SDKs, the same way that you configure replication for unencrypted objects. There aren't additional SSE-C permissions beyond what are currently required for replication.

S3 Replication automatically replicates newly uploaded SSE-C encrypted objects if they are eligible, as per your S3 Replication configuration. To replicate existing objects in your buckets, use S3 Batch Replication. For more information about replicating objects, see Setting up replication and Replicating existing objects with S3 Batch Replication.

There are no additional charges for replicating SSE-C objects. For details about replication pricing, see the Amazon S3 pricing page.

Replicating objects encrypted with SSE-S3 or SSE-KMS

By default, Amazon S3 doesn't replicate objects that are stored at rest by using server-side encryption with customer managed keys that are stored in Amazon Key Management Service (Amazon KMS) (SSE-KMS). This section explains the additional configuration elements that you can add to direct Amazon S3 to replicate these objects.

For an example with step-by-step instructions, see Replicating encrypted objects. For information about creating a replication configuration, see Replicating objects.

Specifying additional information in the replication configuration for SSE-KMS

In the replication configuration, you do the following:

<ReplicationConfiguration>
   <Rule>
      ...
      <SourceSelectionCriteria>
         <SseKmsEncryptedObjects>
           <Status>Enabled</Status>
         </SseKmsEncryptedObjects>
      </SourceSelectionCriteria>

      <Destination>
          ...
          <EncryptionConfiguration>
             <ReplicaKmsKeyID>Amazon KMS key ID that's in the same as the destination bucket.</ReplicaKmsKeyID>
          </EncryptionConfiguration>
       </Destination>
      ...
   </Rule>
</ReplicationConfiguration>

The following example shows a replication configuration that includes optional configuration elements.

<?xml version="1.0" encoding="UTF-8"?>
<ReplicationConfiguration>
   <Role>arn:aws-cn:iam::account-id:role/role-name</Role>
   <Rule>
      <ID>Rule-1</ID>
      <Priority>1</Priority>
      <Status>Enabled</Status>
      <DeleteMarkerReplication>
         <Status>Disabled</Status>
      </DeleteMarkerReplication>
      <Filter>
         <Prefix>Tax</Prefix>
      </Filter>
      <Destination>
         <Bucket>arn:aws-cn:s3:::</Bucket>
         <EncryptionConfiguration>
            <ReplicaKmsKeyID>Amazon KMS key ID that's in the same Amazon Web Services Region as the destination buckets. (S3 uses this key to encrypt object replicas.)</ReplicaKmsKeyID>
         </EncryptionConfiguration>
      </Destination>
      <SourceSelectionCriteria>
         <SseKmsEncryptedObjects>
            <Status>Enabled</Status>
         </SseKmsEncryptedObjects>
      </SourceSelectionCriteria>
   </Rule>
</ReplicationConfiguration>

This replication configuration has one rule. The rule applies to objects with the Tax key prefix. Amazon S3 uses the specified Amazon KMS key ID to encrypt these object replicas.

Granting additional permissions for the IAM role

To replicate objects that are encrypted at rest by using SSE-S3 or SSE-KMS, grant the following additional permissions to the Amazon Identity and Access Management (IAM) role that you specify in the replication configuration. You grant these permissions by updating the permissions policy that's associated with the IAM role.

We recommend that you restrict these permissions only to the destination buckets and objects by using Amazon KMS condition keys. The Amazon Web Services account that owns the IAM role must have permissions for the kms:Encrypt and kms:Decrypt actions for the KMS keys that are listed in the policy. If the KMS keys are owned by another Amazon Web Services account, the owner of the KMS keys must grant these permissions to the Amazon Web Services account that owns the IAM role. For more information about managing access to these KMS keys, see Using IAM Policies with Amazon KMS in the Amazon Key Management Service Developer Guide.

S3 Bucket Keys and replication

To use replication with an S3 Bucket Key, the Amazon KMS key policy for the KMS key that's used to encrypt the object replica must include the kms:Decrypt permission for the calling principal. The call to kms:Decrypt verifies the integrity of the S3 Bucket Key before using it. For more information, see Using an S3 Bucket Key with replication.

When an S3 Bucket Key is enabled for the source or destination bucket, the encryption context will be the bucket's Amazon Resource Name (ARN), not the object's ARN (for example, arn:aws-cn:s3:::bucket_ARN). You must update your IAM policies to use the bucket ARN for the encryption context:

"kms:EncryptionContext:aws:s3:arn": [
"arn:aws-cn:s3:::bucket_ARN"
]

For more information, see Encryption context (x-amz-server-side-encryption-context) (in the "Using the REST API" section) and Changes to note before enabling an S3 Bucket Key.

Example policies – Using SSE-S3 and SSE-KMS with replication

The following example IAM policies show statements for using SSE-S3 and SSE-KMS with replication.

{
    "Action": ["kms:Decrypt"],
    "Effect": "Allow",
    "Condition": {
        "StringLike": {
            "kms:ViaService": "s3.source-bucket-region.amazonaws.com.cn",
            "kms:EncryptionContext:aws:s3:arn": [
                "arn:aws-cn:s3:::/key-prefix1*"
            ]
        }
    },
    "Resource": [
        "List of Amazon KMS key ARNs that are used to encrypt source objects." 
    ]
},
{
    "Action": ["kms:Encrypt"],
    "Effect": "Allow",
    "Condition": {
        "StringLike": {
            "kms:ViaService": "s3.destination-bucket-1-region.amazonaws.com.cn",
            "kms:EncryptionContext:aws:s3:arn": [
                "arn:aws-cn:s3:::/key-prefix1*"
            ]
        }
    },
    "Resource": [
         "Amazon KMS key ARNs (in the same Amazon Web Services Region as destination bucket 1). Used to encrypt object replicas created in destination bucket 1." 
    ]
},
{
    "Action": ["kms:Encrypt"],
    "Effect": "Allow",
    "Condition": {
        "StringLike": {
            "kms:ViaService": "s3.destination-bucket-2-region.amazonaws.com.cn",
            "kms:EncryptionContext:aws:s3:arn": [
                "arn:aws-cn:s3:::/key-prefix1*"
            ]
        }
    },
    "Resource": [
         "Amazon KMS key ARNs (in the same Amazon Web Services Region as destination bucket 2). Used to encrypt object replicas created in destination bucket 2."
    ]
}

{
   "Version":"2012-10-17",
   "Statement":[
      {
         "Effect":"Allow",
         "Action":[
            "s3:GetReplicationConfiguration",
            "s3:ListBucket"
         ],
         "Resource":[
            "arn:aws-cn:s3:::"
         ]
      },
      {
         "Effect":"Allow",
         "Action":[
            "s3:GetObjectVersionForReplication",
            "s3:GetObjectVersionAcl"
         ],
         "Resource":[
            "arn:aws-cn:s3:::/key-prefix1*"
         ]
      },
      {
         "Effect":"Allow",
         "Action":[
            "s3:ReplicateObject",
            "s3:ReplicateDelete"
         ],
         "Resource":"arn:aws-cn:s3:::/key-prefix1*"
      },
      {
         "Action":[
            "kms:Decrypt"
         ],
         "Effect":"Allow",
         "Condition":{
            "StringLike":{
               "kms:ViaService":"s3.source-bucket-region.amazonaws.com.cn",
               "kms:EncryptionContext:aws:s3:arn":[
                  "arn:aws-cn:s3:::/key-prefix1*"
               ]
            }
         },
         "Resource":[
           "List of the Amazon KMS key ARNs that are used to encrypt source objects."
         ]
      },
      {
         "Action":[
            "kms:Encrypt"
         ],
         "Effect":"Allow",
         "Condition":{
            "StringLike":{
               "kms:ViaService":"s3.destination-bucket-region.amazonaws.com.cn",
               "kms:EncryptionContext:aws:s3:arn":[
                  "arn:aws-cn:s3:::/prefix1*"
               ]
            }
         },
         "Resource":[
            "Amazon KMS key ARNs (in the same Amazon Web Services Region as the destination bucket) to use for encrypting object replicas"
         ]
      }
   ]
}

{
   "Version":"2012-10-17",
   "Statement":[
      {
         "Effect":"Allow",
         "Action":[
            "s3:GetReplicationConfiguration",
            "s3:ListBucket"
         ],
         "Resource":[
            "arn:aws-cn:s3:::"
         ]
      },
      {
         "Effect":"Allow",
         "Action":[
            "s3:GetObjectVersionForReplication",
            "s3:GetObjectVersionAcl"
         ],
         "Resource":[
            "arn:aws-cn:s3:::/key-prefix1*"
         ]
      },
      {
         "Effect":"Allow",
         "Action":[
            "s3:ReplicateObject",
            "s3:ReplicateDelete"
         ],
         "Resource":"arn:aws-cn:s3:::/key-prefix1*"
      },
      {
         "Action":[
            "kms:Decrypt"
         ],
         "Effect":"Allow",
         "Condition":{
            "StringLike":{
               "kms:ViaService":"s3.source-bucket-region.amazonaws.com.cn",
               "kms:EncryptionContext:aws:s3:arn":[
                  "arn:aws-cn:s3:::"
               ]
            }
         },
         "Resource":[
           "List of the Amazon KMS key ARNs that are used to encrypt source objects."
         ]
      },
      {
         "Action":[
            "kms:Encrypt"
         ],
         "Effect":"Allow",
         "Condition":{
            "StringLike":{
               "kms:ViaService":"s3.destination-bucket-region.amazonaws.com.cn",
               "kms:EncryptionContext:aws:s3:arn":[
                  "arn:aws-cn:s3:::"
               ]
            }
         },
         "Resource":[
            "Amazon KMS key ARNs (in the same Amazon Web Services Region as the destination bucket) to use for encrypting object replicas"
         ]
      }
   ]
}

Granting additional permissions for cross-account scenarios

In a cross-account scenario, where the source and destination buckets are owned by different Amazon Web Services accounts, you can use a KMS key to encrypt object replicas. However, the KMS key owner must grant the source bucket owner permission to use the KMS key.

Amazon KMS transaction quota considerations

When you add many new objects with Amazon KMS encryption after enabling Cross-Region Replication (CRR), you might experience throttling (HTTP 503 Service Unavailable errors). Throttling occurs when the number of Amazon KMS transactions per second exceeds the current quota. For more information, see Quotas in the Amazon Key Management Service Developer Guide.

To request a quota increase, use Service Quotas. For more information, see Amazon Web Services Quotas. If Service Quotas isn't supported in your Region, open an Amazon Web Services Support case.