Home / AWS / Fix AWS S3 Cross-Region Replication Not Working

AWS

Fix AWS S3 Cross-Region Replication Not Working

Resolve S3 replication failures by checking IAM roles, bucket configurations, versioning settings, and replication rule configurations.

Published: Apr 1, 20267 min readBy FixWikiHub Editorial Team

Abstract illustration for a troubleshooting knowledge base category.

Introduction

S3 Cross-Region Replication (CRR) automatically copies objects from a source bucket to a destination bucket in another region. When replication fails, objects uploaded to the source don't appear in the destination, leading to compliance violations, disaster recovery gaps, or data availability issues.

Symptoms

Replication status pending/failed:

```bash $ aws s3api head-object --bucket source-bucket --key my-file.pdf \ --query 'ReplicationStatus'

"PENDING" # Never transitions to COMPLETED # Or: "FAILED" ```

Destination bucket empty:

```bash $ aws s3 ls s3://dest-bucket/

# Empty despite uploads to source $ aws s3 ls s3://source-bucket/ 2024-01-15 10:00:00 my-file.pdf # Exists in source only ```

Replication metrics:

```bash $ aws cloudwatch get-metric-statistics \ --namespace AWS/S3 \ --metric-name ReplicationPendingOperations \ --dimensions Name=BucketName,Value=source-bucket \ --statistics Sum

# High pending count = replication backlog ```

Common Causes

1.Versioning disabled - Replication requires versioning on both buckets
2.IAM role missing permissions - Role can't read from source or write to destination
3.Destination bucket wrong region - Same-region attempted for CRR
4.Replication rule not configured - No active replication rule
5.Object ownership mismatch - Different AWS accounts require ACL handling
6.Encryption mismatch - KMS keys not accessible in destination region
7.Filter mismatch - Object doesn't match replication rule filter

Step-by-Step Fix

1.Check logs for specific error messages
2.Verify configuration settings
3.Test network connectivity
4.Review recent changes
5.Apply corrective action
6.Verify the fix

Step 1: Check Versioning on Both Buckets

```bash # Source bucket versioning aws s3api get-bucket-versioning --bucket source-bucket

# Must show: "Status": "Enabled"

# Destination bucket versioning aws s3api get-bucket-versioning --bucket dest-bucket

# Must also be enabled ```

Enable versioning:

```bash aws s3api put-bucket-versioning --bucket source-bucket \ --versioning-configuration Status=Enabled

aws s3api put-bucket-versioning --bucket dest-bucket \ --versioning-configuration Status=Enabled ```

Step 2: Verify Replication Configuration

```bash # Check source bucket replication config aws s3api get-bucket-replication --bucket source-bucket

# Should show rules with destination { "Role": "arn:aws:iam::account:role/replication-role", "Rules": [ { "ID": "rule-1", "Status": "Enabled", "Destination": { "Bucket": "arn:aws:s3:::dest-bucket", "StorageClass": "STANDARD" } } ] } ```

If missing, create replication configuration:

bash

aws s3api put-bucket-replication --bucket source-bucket \
  --replication-configuration '{
    "Role": "arn:aws:iam::account:role/s3-replication-role",
    "Rules": [{
      "ID": "replicate-all",
      "Status": "Enabled",
      "Priority": 1,
      "DeleteMarkerReplication": {"Status": "Disabled"},
      "Filter": {},
      "Destination": {
        "Bucket": "arn:aws:s3:::dest-bucket",
        "StorageClass": "STANDARD"
      }
    }]
  }'

Step 3: Verify IAM Role Permissions

```bash # Get replication role aws iam get-role --role-name s3-replication-role

# Check role permissions aws iam get-role-policy --role-name s3-replication-role --policy-name s3-replication-policy ```

Required permissions for source:

json

{
  "Effect": "Allow",
  "Action": [
    "s3:GetReplicationConfiguration",
    "s3:ListBucket",
    "s3:GetObjectVersionForReplication",
    "s3:GetObjectVersionAcl",
    "s3:GetObjectVersionTagging"
  ],
  "Resource": [
    "arn:aws:s3:::source-bucket",
    "arn:aws:s3:::source-bucket/*"
  ]
}

Required permissions for destination:

json

{
  "Effect": "Allow",
  "Action": [
    "s3:ReplicateObject",
    "s3:ReplicateDelete",
    "s3:ReplicateTags",
    "s3:ObjectOwnerOverrideToBucketOwner"
  ],
  "Resource": "arn:aws:s3:::dest-bucket/*"
}

Create role if missing:

```bash aws iam create-role --role-name s3-replication-role \ --assume-role-policy-document '{ "Version": "2012-10-17", "Statement": [{ "Effect": "Allow", "Principal": {"Service": "s3.amazonaws.com"}, "Action": "sts:AssumeRole" }] }'

aws iam put-role-policy --role-name s3-replication-role \ --policy-name replication-policy \ --policy-document file://replication-policy.json ```

Step 4: Check Destination Bucket Ownership

```bash # For cross-account replication, destination needs owner override aws s3api get-bucket-ownership-controls --bucket dest-bucket

# Should show: "ObjectOwnership": "BucketOwnerPreferred"

# Set if missing aws s3api put-bucket-ownership-controls --bucket dest-bucket \ --ownership-controls '{ "Rules": [{ "ObjectOwnership": "BucketOwnerPreferred" }] }' ```

Step 5: Verify KMS Encryption Configuration

For encrypted objects:

```bash # Check source bucket encryption aws s3api get-bucket-encryption --bucket source-bucket

# For SSE-KMS, destination needs key access # Replication config must specify destination key:

aws s3api put-bucket-replication --bucket source-bucket \ --replication-configuration '{ "Role": "arn:aws:iam::account:role/replication-role", "Rules": [{ "Status": "Enabled", "Destination": { "Bucket": "arn:aws:s3:::dest-bucket", "EncryptionConfiguration": { "ReplicaKmsKeyID": "arn:aws:kms:dest-region:account:key/key-id" } } }] }'

# Role needs KMS permissions: { "Effect": "Allow", "Action": ["kms:Decrypt", "kms:Encrypt"], "Resource": ["arn:aws:kms:source-region:account:key/source-key", "arn:aws:kms:dest-region:account:key/dest-key"] } ```

Step 6: Check Replication Rule Filter

```bash # If rule has filter, object must match aws s3api get-bucket-replication --bucket source-bucket \ --query 'ReplicationConfiguration.Rules[*].Filter'

# Filter examples: # Prefix: "logs/" - Only objects with logs/ prefix replicate # Tags: key=value - Only objects with specific tag replicate

# Upload test object matching filter aws s3 cp test.log s3://source-bucket/logs/test.log # Check replication status aws s3api head-object --bucket source-bucket --key logs/test.log \ --query 'ReplicationStatus' ```

Step 7: Monitor Replication Metrics

```bash # Check pending operations aws cloudwatch get-metric-statistics \ --namespace AWS/S3 \ --metric-name BytesPendingReplication \ --dimensions Name=BucketName,Value=source-bucket \ --statistics Sum \ --period 300

# Check replication latency aws cloudwatch get-metric-statistics \ --namespace AWS/S3 \ --metric-name ReplicationLatency \ --dimensions Name=BucketName,Value=source-bucket \ --statistics Maximum ```

Step 8: Replicate Existing Objects

```bash # Replication only applies to new objects by default # Existing objects don't replicate

# Use S3 Batch Replication for existing objects aws s3 create-job \ --account-id account-id \ --operation '{ "S3BatchReplicationOperation": { "BucketArn": "arn:aws:s3:::source-bucket" } }' \ --manifest '{ "Spec": { "Format": "S3InventoryReport_CSV_2016-11-30", "BucketArn": "arn:aws:s3:::inventory-bucket" } }' \ --report '{ "BucketArn": "arn:aws:s3:::report-bucket", "Format": "Report_CSV_20180220", "Enabled": true }' \ --role-arn arn:aws:iam::account:role/batch-replication-role ```

Step 9: Check for Object Lock Configuration

```bash # Object Lock can affect replication aws s3api get-object-lock-configuration --bucket source-bucket

# If Object Lock enabled, destination must also have it aws s3api put-object-lock-configuration --bucket dest-bucket \ --object-lock-configuration '{ "ObjectLockEnabled": "Enabled", "Rule": { "DefaultRetention": { "Mode": "GOVERNANCE", "Days": 30 } } }' ```

Step 10: Troubleshoot Specific Objects

```bash # Check object replication status aws s3api head-object --bucket source-bucket --key specific-object \ --query '{Status:ReplicationStatus,Version:VersionId}'

# FAILED status indicates: # - Encryption key issue # - Permission denied # - Destination bucket problem

# Check replication time control metrics (if enabled) aws s3api get-bucket-replication --bucket source-bucket \ --query 'ReplicationConfiguration.Rules[*].Metrics' ```

Verification

```bash # Upload new object aws s3 cp test-file.txt s3://source-bucket/test-file.txt

# Wait 1-2 minutes # Check replication status aws s3api head-object --bucket source-bucket --key test-file.txt \ --query 'ReplicationStatus'

# Should show: COMPLETED

# Verify in destination aws s3 ls s3://dest-bucket/test-file.txt

# Should exist ```

Replication Status Values

Status	Meaning
PENDING	Queued for replication
COMPLETED	Successfully replicated
FAILED	Replication error
REPLICA	This is a replica object

[Fix AWS S3 Bucket Policy Denied](/articles/fix-aws-s3-bucket-policy-denied)
[Fix AWS S3 Lifecycle Rule Not Expiring](/articles/fix-aws-s3-lifecycle-rule-not-expiring)
[Fix AWS S3 CORS Config Missing](/articles/fix-aws-s3-cors-config-missing)

[AWS troubleshooting: Fix IAM Permission Denied - Complete Tro](fix-iam-permission-denied)
[AWS cloud troubleshooting: AWS ACM Certificate Pending Validation Because the](aws-acm-certificate-pending-validation-wrong-route53-zone)
[AWS cloud troubleshooting: AWS ALB Returns 502 Because the Target Closed the ](aws-alb-502-target-closed-connection-keepalive-timeout-mismatch)
[AWS cloud troubleshooting: Fix AWS ALB CreateListener TargetGroupNotFound Err](aws-alb-createlistener-targetgroupnotfound)
[AWS cloud troubleshooting: Fix Aws Alb Lambda 502 Bad Gateway Issue in AWS](aws-alb-lambda-502-bad-gateway)

Was this guide helpful?

Related search paths

People also search for

If the symptom is close but not identical, these search paths usually surface the right neighboring fixes faster than scrolling the full archive.

AWS S3 Cross-Region Replication Not Working AWS S3 Cross-Region Replication Not Working AWS AWS S3 Cross-Region Replication Not Working troubleshooting AWS S3 Cross-Region Replication Not Working fix Resolve S3 replication failures by checking IAM roles, bucket configurations, versioning settings, and replication rule configurations AWS Resolve S3 replication failures by checking IAM roles, bucket configurations, versioning settings, and replication rule configurations

Explore Related Topics

Browse Guides from Other Categories

Discover troubleshooting guides from related categories to expand your knowledge.

FAQ

AWS Troubleshooting FAQs

Common questions about troubleshooting and preventing similar issues

How do I know if this aws-errors troubleshooting guide applies to my situation?

This guide is designed for aws-errors issues. If you're experiencing similar symptoms described in the article, follow the step-by-step instructions. Start with the most common causes and work through the diagnostic process.

Is it safe to follow these aws-errors troubleshooting steps?

Yes, all steps are designed to be safe and non-destructive. We recommend creating backups before making significant changes and testing each step before proceeding to the next.

How long does it typically take to resolve this type of aws-errors issue?

Most aws-errors issues can be resolved within 30 minutes to 2 hours, depending on the complexity and root cause. Follow the troubleshooting flow to identify and fix the problem efficiently.

How can I prevent this aws-errors issue from happening again?

Regular maintenance, monitoring, and following best practices for aws-errors configuration can help prevent recurrence. Consider implementing automated checks and alerts for early detection.

Written by

FixWikiHub Editorial Team

Our editorial team consists of experienced DevOps engineers, systems administrators, and cloud architects with hands-on experience in production environments across AWS, Azure, GCP, and on-premises infrastructure.

Every guide undergoes technical review for accuracy and is updated when software versions, commands, or best practices change.

Last updated: Apr 1, 2026

About our team

Important Notice

Disclaimer & Safety Guidelines

The troubleshooting steps in this guide are provided for educational and informational purposes. Before applying any changes to production systems:

Test in a staging environment first — Always verify commands and configurations in a non-production environment before deploying to live systems.
Create backups — Ensure you have current backups of databases, configurations, and critical files before making changes.
Understand the impact — Review how each step may affect your specific environment, dependencies, and users.
Consult official documentation — This guide supplements, but does not replace, official vendor documentation and best practices.

FixWikiHub is not responsible for any damages arising from the use of this content. See our Terms of Use for more information.

Resources

Official Documentation & Further Reading

For authoritative information, consult the official documentation for the technologies discussed in this guide. Our troubleshooting content supplements, but does not replace, vendor documentation.

AWS Documentation — Official Amazon Web Services guides and API references
Kubernetes Documentation — Official Kubernetes documentation
Nginx Documentation — Official Nginx web server documentation
Apache Documentation — Official Apache HTTP Server documentation
Docker Documentation — Official Docker container documentation

Fix AWS S3 Cross-Region Replication Not Working

Introduction

Symptoms

Common Causes

Step-by-Step Fix

Step 1: Check Versioning on Both Buckets

Step 2: Verify Replication Configuration

Step 3: Verify IAM Role Permissions

Step 4: Check Destination Bucket Ownership

Step 5: Verify KMS Encryption Configuration

Step 6: Check Replication Rule Filter

Step 7: Monitor Replication Metrics

Step 8: Replicate Existing Objects

Step 9: Check for Object Lock Configuration

Step 10: Troubleshoot Specific Objects

Verification

Replication Status Values

People also search for

Browse Guides from Other Categories

WordPress

SSL

DNS

AWS Troubleshooting FAQs

FixWikiHub Editorial Team

Disclaimer & Safety Guidelines

Official Documentation & Further Reading

Fix AWS S3 Cross-Region Replication Not Working

Introduction

Symptoms

Common Causes

Step-by-Step Fix

Step 1: Check Versioning on Both Buckets

Step 2: Verify Replication Configuration

Step 3: Verify IAM Role Permissions

Step 4: Check Destination Bucket Ownership

Step 5: Verify KMS Encryption Configuration

Step 6: Check Replication Rule Filter

Step 7: Monitor Replication Metrics

Step 8: Replicate Existing Objects

Step 9: Check for Object Lock Configuration

Step 10: Troubleshoot Specific Objects

Verification

Replication Status Values

Related Issues

Related Articles

People also search for

Share this guide

More AWS Troubleshooting Guides

Browse Guides from Other Categories

AWS Troubleshooting FAQs

FixWikiHub Editorial Team

Disclaimer & Safety Guidelines

Official Documentation & Further Reading