AWS S3 Cross‑Region Replication – My Learning Journey

My Story – Persistence Pays Off

I messed up. I accidentally deleted the CRR IAM role and kept asking AI for help. Four hours later, after digging deep and never giving up, the AI finally pointed me to this amazing YouTube video. Using that guidance, I finally managed to copy all 21 files safely. It was a tough ride, but it taught me a lot. We live, we learn, and we keep going!

Why Two IAM Roles & Cross‑Account/Cross‑Region Setup?

One IAM role in the source account allows S3 to replicate objects.
Another IAM role in the destination account (for cross-account) allows the source to write safely.
Any missing role or permission mismatch can block replication and cause “Pending” or “Failed” objects.
Cross-region replication adds extra complexity with regional endpoints, KMS keys, and bucket policies.

Step‑by‑Step Process

Create the source bucket (original region/account).
Create the destination bucket (target region/account).
Enable versioning on both source and destination buckets (required for replication).
Destination account: create IAM role that allows source account to write; set trust policy.
Source account: create IAM role for replication; assign permissions and trust S3 service.
Enable replication on the source bucket, choose destination bucket, assign roles, set rules.
Check bucket policies to allow the replication roles to read/write.
Test by uploading an object; check replication status (“COMPLETED”).
Debug any errors via CloudTrail, CloudWatch, or S3 metrics.

Lessons Learned

Deleting a required IAM role breaks replication chain—trust the system!
Persistence matters: asking AI and following the right resources finally worked.
Even a small setup mistake can cost hours, but the learning sticks forever.
Testing small objects first is critical before trusting large replication jobs.
Show some vulnerability—AWS is tricky, even for experienced users. Admitting mistakes helps you learn faster.
Versioning is mandatory: without it, replication cannot work properly.
Just an update really, I did go through a rabbits tunnel to get this full working, I added several permissions in IAM role to get this working of which is not needed, and used Batching, and used this a good 5 or 6 times, and forgot to delete the bucket. My average bill can be around 60 pence for my domain/dns registration. But it has gone upto £3.30 so costly this month. Well and truly learnt a lesson