---
id: 1540e7cf-5a79-469b-a990-4209d6401983
---

# Issues with Amazon S3 Object Replication Configuration
---

This incident type involves issues with replicating objects in Amazon S3 buckets after configuring replication. Replication issues can be caused by various factors, such as incorrect bucket ARN, incorrect key name prefix, suspended versioning, and missing permissions. Troubleshooting tips involve checking the replication status, verifying configuration settings, and ensuring that necessary permissions are granted. Replication time can also vary depending on the object size and source-destination region pair.

### Parameters
```shell
export OBJECT_KEY="PLACEHOLDER"

export BUCKET_NAME="PLACEHOLDER"

export REPLICATION_ROLE_ARN="PLACEHOLDER"

export DESTINATION_BUCKET_NAME="PLACEHOLDER"

export DESTINATION_BUCKET_ARN="PLACEHOLDER"
```

## Debug

### Check replication status of a specific object
```shell
aws s3api head-object --bucket ${BUCKET_NAME} --key ${OBJECT_KEY} --query "ReplicationStatus"
```

### List all versions of an object
```shell
aws s3api list-object-versions --bucket ${BUCKET_NAME} --prefix ${OBJECT_KEY}
```

### List all replication configurations for a bucket
```shell
aws s3api get-bucket-replication --bucket ${BUCKET_NAME}
```

### Check if versioning is enabled for a bucket
```shell
aws s3api get-bucket-versioning --bucket ${BUCKET_NAME}
```

### Get bucket policy for a specific bucket
```shell
aws s3api get-bucket-policy --bucket ${BUCKET_NAME}
```

### Check if a specific bucket policy statement grants s3:ObjectOwnerOverrideToBucketOwner permission
```shell
aws s3api get-bucket-policy --bucket ${DESTINATION_BUCKET_NAME} | jq -r '.Policy' | jq 'select(.Statement[] | select(.Effect == "Allow" and .Action == "s3:ObjectOwnerOverrideToBucketOwner"))'
```

## Repair

### Update or Verify that the ARN of the destination bucket is correct in the replication configuration on the source bucket.
```shell


#!/bin/bash



# Set variables

source_bucket=${BUCKET_NAME}

destination_bucket=${DESTINATION_BUCKET_ARN}

replication_role_arn=${REPLICATION_ROLE_ARN}



# Get the replication configuration of the source bucket

replication_config=$(aws s3api get-bucket-replication --bucket $source_bucket)



# Get the ARN of the destination bucket from the replication configuration

destination_bucket_arn=$(echo $replication_config | jq -r '.ReplicationConfiguration.Rules[].Destination.Bucket == "'$destination_bucket'") | .BucketArn')



if [ "$destination_bucket" != "$destination_bucket_arn" ]; then

  echo "Destination bucket ARN is incorrect in the replication configuration."

  echo "Updating the replication configuration with the correct ARN..."

  

  # Update the replication configuration with the correct destination bucket ARN

  aws s3api put-bucket-replication --bucket $source_bucket --replication-configuration "{\"Role\":\"$replication_role_arn\",\"Rules\":[{\"Status\":\"Enabled\",\"Destination\":{\"Bucket\":\"$destination_bucket\",\"Prefix\":\"\",\"Id\":\"default-rule\",\"Priority\":1}]}"

  

  echo "Replication configuration updated successfully."

else

  echo "Destination bucket ARN is correct in the replication configuration."

fi


```

This incident type involves issues with replicating objects in Amazon S3 buckets after configuring replication. Replication issues can be caused by various factors, such as incorrect bucket ARN, incorrect key name prefix, suspended versioning, and missing permissions. Troubleshooting tips involve checking the replication status, verifying configuration settings, and ensuring that necessary permissions are granted. Replication time can also vary depending on the object size and source-destination region pair.


```shell
export OBJECT_KEY="PLACEHOLDER"

export BUCKET_NAME="PLACEHOLDER"

export REPLICATION_ROLE_ARN="PLACEHOLDER"

export DESTINATION_BUCKET_NAME="PLACEHOLDER"

export DESTINATION_BUCKET_ARN="PLACEHOLDER"
```


### Check replication status of a specific object

```shell
aws s3api head-object --bucket ${BUCKET_NAME} --key ${OBJECT_KEY} --query "ReplicationStatus"
```

### List all versions of an object

```shell
aws s3api list-object-versions --bucket ${BUCKET_NAME} --prefix ${OBJECT_KEY}
```

### List all replication configurations for a bucket

```shell
aws s3api get-bucket-replication --bucket ${BUCKET_NAME}
```

### Check if versioning is enabled for a bucket

```shell
aws s3api get-bucket-versioning --bucket ${BUCKET_NAME}
```

### Get bucket policy for a specific bucket

```shell
aws s3api get-bucket-policy --bucket ${BUCKET_NAME}
```

### Check if a specific bucket policy statement grants s3:ObjectOwnerOverrideToBucketOwner permission

```shell
aws s3api get-bucket-policy --bucket ${DESTINATION_BUCKET_NAME} | jq -r '.Policy' | jq 'select(.Statement[] | select(.Effect == "Allow" and .Action == "s3:ObjectOwnerOverrideToBucketOwner"))'
```


### Update or Verify that the ARN of the destination bucket is correct in the replication configuration on the source bucket.

```shell


#!/bin/bash



# Set variables

source_bucket=${BUCKET_NAME}

destination_bucket=${DESTINATION_BUCKET_ARN}

replication_role_arn=${REPLICATION_ROLE_ARN}



# Get the replication configuration of the source bucket

replication_config=$(aws s3api get-bucket-replication --bucket $source_bucket)



# Get the ARN of the destination bucket from the replication configuration

destination_bucket_arn=$(echo $replication_config | jq -r '.ReplicationConfiguration.Rules[].Destination.Bucket == "'$destination_bucket'") | .BucketArn')



if [ "$destination_bucket" != "$destination_bucket_arn" ]; then

  echo "Destination bucket ARN is incorrect in the replication configuration."

  echo "Updating the replication configuration with the correct ARN..."

  

  # Update the replication configuration with the correct destination bucket ARN

  aws s3api put-bucket-replication --bucket $source_bucket --replication-configuration "{\"Role\":\"$replication_role_arn\",\"Rules\":[{\"Status\":\"Enabled\",\"Destination\":{\"Bucket\":\"$destination_bucket\",\"Prefix\":\"\",\"Id\":\"default-rule\",\"Priority\":1}]}"

  

  echo "Replication configuration updated successfully."

else

  echo "Destination bucket ARN is correct in the replication configuration."

fi


```


Issues with Amazon S3 Object Replication Configuration

Overview

Parameters

Debug

Check replication status of a specific object

List all versions of an object

List all replication configurations for a bucket

Check if versioning is enabled for a bucket

Get bucket policy for a specific bucket

Check if a specific bucket policy statement grants s3:ObjectOwnerOverrideToBucketOwner permission

Repair

Update or Verify that the ARN of the destination bucket is correct in the replication configuration on the source bucket.

Learn more

Related Runbooks

Support