通过复制规则进行跨帐户S3桶复制

Question

我有两个桶：

• “source-bucket”（在AWS帐户88888888中）。
• “目的地-桶”（在AWS帐户99999999中）

两个桶都启用了版本控制，并且位于同一区域(eu-west-1)。

在源桶中，我创建了一个具有以下设置的复制规则：

我选择了自动角色创建，它使用以下策略创建了一个角色：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "s3:ListBucket",
                "s3:GetReplicationConfiguration",
                "s3:GetObjectVersionForReplication",
                "s3:GetObjectVersionAcl",
                "s3:GetObjectVersionTagging",
                "s3:GetObjectRetention",
                "s3:GetObjectLegalHold"
            ],
            "Effect": "Allow",
            "Resource": [
                "arn:aws:s3:::source-bucket",
                "arn:aws:s3:::source-bucket/*",
                "arn:aws:s3:::destination-bucket",
                "arn:aws:s3:::destination-bucket/*"
            ]
        },
        {
            "Action": [
                "s3:ReplicateObject",
                "s3:ReplicateDelete",
                "s3:ReplicateTags",
                "s3:ObjectOwnerOverrideToBucketOwner"
            ],
            "Effect": "Allow",
            "Resource": [
                "arn:aws:s3:::source-bucket/*",
                "arn:aws:s3:::destination-bucket/*"
            ]
        }
    ]
}

根据这里找到的文档https://docs.aws.amazon.com/amazons3/latest/userguide/replication-walkthrough-2.html" target="_blank">html，我在“destination-bucket”中添加了一个bucket策略，如下所示：

{
    "Version": "2012-10-17",
    "Id": "",
    "Statement": [
        {
            "Sid": "Set permissions for objects",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::88888888:role/service-role/auto-created-role"
            },
            "Action": [
                "s3:ReplicateObject",
                "s3:ReplicateDelete"
            ],
            "Resource": "arn:aws:s3:::destination-bucket/*"
        },
        {
            "Sid": "Set permissions on bucket",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::88888888:role/service-role/auto-created-role"
            },
            "Action": [
                "s3:GetBucketVersioning",
                "s3:PutBucketVersioning"
            ],
            "Resource": "arn:aws:s3:::destination-bucket"
        }
    ]
}

但是，当我将一个文件添加到源桶中时，似乎什么也没有发生。有人知道这里会出什么问题吗？

Answer 1

看看这是否有帮助。

默认情况下，Amazon S3不会使用AWS密钥管理服务（AWS KMS）客户主密钥（CMKs）的服务器端加密复制静止存储的对象。要复制加密的对象，需要修改bucket复制配置，以告诉Amazon S3复制这些对象。

https://docs.aws.amazon.com/amazons3/latest/userguide/replication-walkthrough-4.html