By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post

S3 Bucket Keys and CRR

0

Has anyone been able to get S3 bucket keys to work with CRR? I tried enabling bucket keys (on both source and destination buckets) and my previously working CRR stopped working. I disabled bucket keys and CRR started working again. Documentation doesn't list any additional steps https://docs.aws.amazon.com/AmazonS3/latest/dev/bucket-key.html

Thanks!

Topics
StorageSecurity, Identity, & Compliance
Tags
Amazon Simple Storage ServiceAWS Key Management Service
Language
English
AWS
AWS-User-2559842
asked 3 years ago356 views
1 Answer
0
Accepted Answer

If your replication role policy previously match by this field "kms:EncryptionContext:aws:s3:arn", you will need to update it so it's just the bucket ARN. See "Changes to note before enabling an S3 Bucket Key" on https://docs.aws.amazon.com/AmazonS3/latest/dev/bucket-key.html#bucket-key-changes - S3 Bucket Keys uses bucket ARN as encryption context, while previously KMS encryption uses object ARN. Also, you do not have to enable S3 Bucket Keys on both source and destination buckets for replication to work.

AWS
AWS-User-0154594
answered 3 years ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions

Relevant content