<p>So I verified it was definitely public access causing the issue somehow; uploading an identical file but with the public read acl on totally broke it.</p>

<p>I worked with AWS support and they noticed I had "Block public access" enabled in the destination bucket.  Apparently rather than replicating the object and then making it private, it just fails replication.</p>

<p>tl;dr if you want to replicate objects that are public read, don't block public read at the destination.</p>

CC BY-SA 4.0
2019-06-05T17:08:04.153Z
2019-06-05T17:08:04.153Z
Aaron R.
<p>I've followed the documentation to set up cross-region replication to another AWS account.  It looked like it was working correctly until I noticed an entire prefix was missing.</p>

<p>Here is my destination bucket policy:</p>

<pre><code>{
    "Version": "2008-10-17",
    "Id": "S3-Console-Replication-Policy",
    "Statement": [
        {
            "Sid": "S3ReplicationPolicyStmt1",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::&lt;awsaccount&gt;:root"
            },
            "Action": [
                "s3:GetBucketVersioning",
                "s3:PutBucketVersioning",
                "s3:ReplicateObject",
                "s3:ReplicateDelete",
                "s3:ObjectOwnerOverrideToBucketOwner"
            ],
            "Resource": [
                "arn:aws:s3:::bucket-backup",
                "arn:aws:s3:::bucket-backup/*"
            ]
        }
    ]
}
</code></pre>

<p>Looking further into it, I have also realized this particular prefix is where we store our public-access data, so maybe that's related somehow?</p>

<amazon-web-services><amazon-s3>
Why isn't my S3 Cross Region Replication working for some files?
Aaron R.
# Why isn't my S3 Cross Region Replication working for some files?

(Asked by: username_0 on 2019-06-05)

I've followed the documentation to set up cross-region replication to another AWS account.  It looked like it was working correctly until I noticed an entire prefix was missing.
Here is my destination bucket policy:
{
    "Version": "2008-10-17",
    "Id": "S3-Console-Replication-Policy",
    "Statement": [
        {
            "Sid": "S3ReplicationPolicyStmt1",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam:::root"
            },
            "Action": [
                "s3:GetBucketVersioning",
                "s3:PutBucketVersioning",
                "s3:ReplicateObject",
                "s3:ReplicateDelete",
                "s3:ObjectOwnerOverrideToBucketOwner"
            ],
            "Resource": [
                "arn:aws:s3:::bucket-backup",
                "arn:aws:s3:::bucket-backup/*"
            ]
        }
    ]
}

Looking further into it, I have also realized this particular prefix is where we store our public-access data, so maybe that's related somehow?

**Tags:** amazon-web-services, amazon-s3


---

## 1 answers

### Answer by username_0 on 2019-06-05. Score: 2

So I verified it was definitely public access causing the issue somehow; uploading an identical file but with the public read acl on totally broke it.

I worked with AWS support and they noticed I had "Block public access" enabled in the destination bucket. Apparently rather than replicating the object and then making it private, it just fails replication.

tl;dr if you want to replicate objects that are public read, don't block public read at the destination.


---

