Setting up permissions for live replication (original) (raw)

When setting up live replication in Amazon S3, you must acquire the necessary permissions as follows:

Topics

Setting up permissions to create replication rules

The IAM user or role that you will use to create replication rules needs permissions to create replication rules for one- or two-way replications. If the user or role doesn't have these permissions, you won't be able to create replication rules. For more information, see IAM Identities in the IAM User Guide.

The user or role needs the following actions:

Following is a sample IAM policy that includes these actions.


{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetAccessPoint",
                "s3:GetAccountPublicAccessBlock",
                "s3:GetBucketAcl",
                "s3:GetBucketLocation",
                "s3:GetBucketPolicyStatus",
                "s3:GetBucketPublicAccessBlock",
                "s3:ListAccessPoints",
                "s3:ListAllMyBuckets",
                "s3:PutReplicationConfiguration",
                "s3:GetReplicationConfiguration",
                "s3:GetBucketVersioning",
                "s3:GetObjectVersionForReplication",
                "s3:GetObjectVersionAcl",
                "s3:GetObject",
                "s3:ListBucket",
                "s3:GetObjectVersion",
                "s3:GetBucketOwnershipControls",
                "s3:PutBucketOwnershipControls",
                "s3:GetObjectLegalHold",
                "s3:GetObjectRetention",
                "s3:GetBucketObjectLockConfiguration"
            ],
            "Resource": [
                "arn:aws:s3:::amzn-s3-demo-bucket1-*",
                "arn:aws:s3:::amzn-s3-demo-bucket2-*/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:List*AccessPoint*",
                "s3:GetMultiRegion*"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "iam:Get*",
                "iam:CreateServiceLinkedRole",
                "iam:CreateRole",
                "iam:PassRole"
            ],
            "Resource": "arn:aws:iam::*:role/service-role/s3*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "iam:List*"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "iam:AttachRolePolicy",
                "iam:PutRolePolicy",
                "iam:CreatePolicy"
              ],
            "Resource": [
                "arn:aws:iam::*:policy/service-role/s3*",
                "arn:aws:iam::*:role/service-role/s3*"
            ]
        }
    ]
}

Creating an IAM role

By default, all Amazon S3 resources—buckets, objects, and related subresources—are private, and only the resource owner can access the resource. Amazon S3 needs permissions to read and replicate objects from the source bucket. You grant these permissions by creating an IAM role and specifying that role in your replication configuration.

This section explains the trust policy and the minimum required permissions policy that are attached to this IAM role. The example walkthroughs provide step-by-step instructions to create an IAM role. For more information, see Examples for configuring live replication.

The trust policy identifies which principal identities can assume the IAM role. The permissions policy specifies which actions the IAM role can perform, on which resources, and under what conditions. 

{  
   "Version":"2012-10-17",  
   "Statement":[  
      {  
         "Effect":"Allow",  
         "Principal":{  
            "Service":"s3.amazonaws.com"  
         },  
         "Action":"sts:AssumeRole"  
      }  
   ]  
}  
{  
   "Version":"2012-10-17",  
   "Statement":[  
      {  
         "Effect":"Allow",  
         "Principal":{  
            "Service": [  
              "s3.amazonaws.com",  
              "batchoperations.s3.amazonaws.com"  
           ]  
         },  
         "Action":"sts:AssumeRole"  
      }  
   ]  
}

For more information about IAM roles, see IAM roles in the IAM User Guide.

{  
   "Version":"2012-10-17",  
   "Statement":[  
      {  
         "Effect":"Allow",  
         "Action":[  
            "s3:GetReplicationConfiguration",  
            "s3:ListBucket"  
         ],  
         "Resource":[  
            "arn:aws:s3:::amzn-s3-demo-source-bucket"  
         ]  
      },  
      {  
         "Effect":"Allow",  
         "Action":[  
            "s3:GetObjectVersionForReplication",  
            "s3:GetObjectVersionAcl",  
            "s3:GetObjectVersionTagging"  
         ],  
         "Resource":[  
            "arn:aws:s3:::amzn-s3-demo-source-bucket/*"  
         ]  
      },  
      {  
         "Effect":"Allow",  
         "Action":[  
            "s3:ReplicateObject",  
            "s3:ReplicateDelete",  
            "s3:ReplicateTags"  
         ],  
         "Resource":"arn:aws:s3:::amzn-s3-demo-destination-bucket/*"  
      }  
   ]  
}

The permissions policy grants permissions for the following actions:

Note

Permissions for the s3:ReplicateObject action on the`amzn-s3-demo-destination-bucket` bucket also allow replication of metadata such as object tags and ACLs. Therefore, you don't need to explicitly grant permission for the s3:ReplicateTags action.

Important

The AWS account that owns the IAM role must have permissions for the actions that it grants to the IAM role.
For example, suppose that the source bucket contains objects owned by another AWS account. The owner of the objects must explicitly grant the AWS account that owns the IAM role the required permissions through the objects' access control lists (ACLs). Otherwise, Amazon S3 can't access the objects, and replication of the objects fails. For information about ACL permissions, see Access control list (ACL) overview.
The permissions described here are related to the minimum replication configuration. If you choose to add optional replication configurations, you must grant additional permissions to Amazon S3:

Granting permissions when the source and destination buckets are owned by different AWS accounts

When the source and destination buckets aren't owned by the same accounts, the owner of the destination bucket must also add a bucket policy to grant the owner of the source bucket permissions to perform replication actions, as shown in the following example. In this example policy, `amzn-s3-demo-destination-bucket` is the destination bucket.

You can also use the Amazon S3 console to automatically generate this bucket policy for you. For more information, see Enable receiving replicated objects from a source bucket.

Note

The ARN format of the role might appear different. If the role was created by using the console, the ARN format isarn:aws:iam::`account-ID`:role/service-role/`role-name`. If the role was created by using the AWS CLI, the ARN format isarn:aws:iam::`account-ID`:role/`role-name`. For more information, see IAM roles in the IAM User Guide. 

{
   "Version":"2012-10-17",
   "Id":"PolicyForDestinationBucket",
   "Statement":[
      {
         "Sid":"Permissions on objects",
         "Effect":"Allow",
         "Principal":{
            "AWS":"arn:aws:iam::source-bucket-account-ID:role/service-role/source-account-IAM-role"
         },
         "Action":[
            "s3:ReplicateDelete",
            "s3:ReplicateObject"
         ],
         "Resource":"arn:aws:s3:::amzn-s3-demo-destination-bucket/*"
      },
      {
         "Sid":"Permissions on bucket",
         "Effect":"Allow",
         "Principal":{
            "AWS":"arn:aws:iam::source-bucket-account-ID:role/service-role/source-account-IAM-role"
         },
         "Action": [
            "s3:List*",
            "s3:GetBucketVersioning",
            "s3:PutBucketVersioning"
         ],
         "Resource":"arn:aws:s3:::amzn-s3-demo-destination-bucket"
      }
   ]
}

For an example, see Configuring replication for buckets in different accounts.

If objects in the source bucket are tagged, note the following:

...  
   "Statement":[  
      {  
         "Effect":"Deny",  
         "Principal":{  
            "AWS":"arn:aws:iam::source-bucket-account-id:role/service-role/source-account-IAM-role"  
         },  
         "Action":"s3:ReplicateTags",  
         "Resource":"arn:aws:s3:::amzn-s3-demo-destination-bucket/*"  
      }  
   ]  
...
Note
Enable receiving replicated objects from a source bucket

Instead of manually adding the preceding policy to your destination bucket, you can quickly generate the policies needed to enable receiving replicated objects from a source bucket through the Amazon S3 console.

  1. Sign in to the AWS Management Console and open the Amazon S3 console athttps://console.aws.amazon.com/s3/.
  2. In the left navigation pane, choose Buckets.
  3. In the Buckets list, choose the bucket that you want to use as a destination bucket.
  4. Choose the Management tab, and scroll down toReplication rules.
  5. For Actions, choose Receive replicated objects.
    Follow the prompts and enter the AWS account ID of the source bucket account, and then choose Generate policies. The console generates an Amazon S3 bucket policy and a KMS key policy.
  6. To add this policy to your existing bucket policy, either choose Apply settings or choose Copy to manually copy the changes.
  7. (Optional) Copy the AWS KMS policy to your desired KMS key policy in the AWS Key Management Service console.

Changing replica ownership

When different AWS accounts own the source and destination buckets, you can tell Amazon S3 to change the ownership of the replica to the AWS account that owns the destination bucket. For more information about owner override, see Changing the replica owner.

Granting permissions for S3 Batch Operations

S3 Batch Replication provides you a way to replicate the following objects:

You can create a one-time Batch Replication job when creating the first rule in a new replication configuration or when adding a new destination to an existing configuration through the Amazon S3 console. You can also initiate Batch Replication for an existing replication configuration by creating a Batch Operations job.

For a Batch Replication IAM role and policy examples, see Configuring an IAM role for S3 Batch Replication.