Object Replication Across Different Accounts

Bucket-level cross-account replication enables you to utilize resources in different buckets across Wasabi account(s) for your web applications.

While creating a job to replicate objects across different accounts, you will name a destination bucket. Before following the instructions below, you must:

• Define a role, as described in Creating and Deleting a Rule.

• Know the Account ID for the destination bucket. To find the Account ID, click Settings on the Wasabi Console navigation panel. (All account information is blurred in this example.)
  

During the instructions, you will:

• Create a policy in the source account.

• Add a policy to the destination bucket.

For a description of how to add a policy, refer to Reviewing the Policies Panel and Creating a Policy.

Creating a Rule to Replication Objects Across Different Accounts

1. In the source account, create a policy such as:

   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Sid": "Set-Permissions-for-objects",
         "Effect": "Allow",
         "Action": [
           "s3:ReplicateDelete",
           "s3:ReplicateObject",
           "s3:ReplicateTags",
           "s3:List*",
           "s3:GetBucketVersioning",
           "s3:PutBucketVersioning"
         ],
         "Resource": [
           "arn:aws:s3:::source-bucket/",
           "arn:aws:s3:::source-bucket",
           "arn:aws:s3:::destination-bucket/",
           "arn:aws:s3:::destination-bucket"
         ]
       }
     ]
   }

2. In the destination account, access the destination bucket. Click Settings and Permissions. Click Edit and add the following policy. Be sure to click Save.

    {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Sid": "Set-Permissions-for-objects",
         "Effect": "Allow",
         "Principal": {
           "AWS": "arn:aws:iam::100000XXXXXX:role/rolename"
         },
         "Action": [
           "s3:ReplicateDelete",
           "s3:ReplicateObject",
           "s3:ReplicateTags"
         ],
         "Resource": [
           "arn:aws:s3:::destination-bucket/",
           "arn:aws:s3:::destination-bucket"
         ]
       },
       {
         "Sid": "Set permissions on bucket",
         "Effect": "Allow",
         "Principal": {
           "AWS": "arn:aws:iam::100000XXXXXX:role/rolename"
         },
         "Action": [
           "s3:List",
           "s3:GetBucketVersioning",
           "s3:PutBucketVersioning"
         ],
         "Resource": "arn:aws:s3:::destination-bucket"
       }
     ]
   }

3. You are ready to create the replication in the source bucket. To do so, either:

   • Click for the desired bucket on the Buckets list. Select Replicate Bucket on the drop-down menu. Continue with Step 4.

   • Click to select the bucket on the Buckets list. Click to open Settings. Click the Object Replication tab.

     If there are no existing replication jobs, you will see:

     

     If there are existing jobs, you will see a listing such as:

     

     Click Create Replication Rule.

4. The Create Replication Rule panel is displayed with the Source Bucket and the region in which it was created.

   

   Click one of the Replication Type options:

   • Rule + Batch Job—All new and existing objects from the source bucket will be replicated in the destination bucket. This is a “live replication.”

   • Rule—Only new objects from the source bucket will be replicated in the destination bucket. This is a "batch replication."

5. For the Object Selection, choose to replicate:

   • All objects in the bucket

   • A subset of objects in the bucket—With this option, you can add a prefix to filter objects that will be copied from the source bucket. In the following example, only objects in the source bucket that have a name that begins with the text, schematic, will be copied to the destination bucket.

     

     In addition, you can add object tags on which to filter objects to be replicated. Click the pencil icon and then refer to Object Tags for instructions on adding a tag.

     If you apply tags, you will not be able to select the Sync deleted objects advanced option (described in the next step).

     If you specify both a prefix and object tag(s), all conditions must be met for the source bucket object to be copied to the destination bucket. In the following example, only objects in the source bucket that meet the following conditions will be replicated:

     • The object name begins with schematic AND

     • The object has tags of line: arrowhead and release: 101.

     

6. In the Advanced Options section, you can select Sync deleted objects, which indicates that objects deleted in the source bucket will also be deleted in the destination bucket.

   You cannot select the Sync deleted objects advanced option if you applied object tags to filter.

7. Click Next.

8. For the Replication Destination, click Replicate to a bucket in another account.

   (For the Replicate to a bucket within this account option, refer to Object Replication in the Same Account. This enables you to replicate objects across different buckets in the same account.)

9. Enter a name for the replication job. The job name is ComponentReplication02 in the example below.

10. Select a role from the drop-down of available options. This role will be applied to all cross-account replication jobs in this bucket.

11. Enter the ID for the destination account (blurred in this example below).

12. Enter the name of the destination bucket for the cross-account. (The destination bucket must match the versioning status and be within the same continent as the source bucket.

13. Click Next.

14. Review the Replication Rule definition. For example:

15. You can click Back to make changes. Or click Create.

The Replication Rules panel will appear similar to:

Reviewing the Replication Job Panel and Managing Jobs

Refer to Object Replication: Managing a Job.