Question

A company stores sensitive financial records in an S3 bucket in us-east-1 that is encrypted with a customer managed KMS key (CMK-A) using SSE-KMS. For disaster recovery, they configure S3 Cross-Region Replication (CRR) to a destination bucket in eu-west-1, which is encrypted with a different customer managed KMS key (CMK-B). After enabling replication, new objects fail to replicate and remain in a 'FAILED' status. What is the MOST likely cause and correct remediation?

Accepted Answer

The S3 replication IAM role lacks kms:Decrypt permission on CMK-A in us-east-1 and kms:Encrypt permission on CMK-B in eu-west-1; update the role's policy to grant both.

Answer

CRR does not support objects encrypted with SSE-KMS; the source objects must be re-encrypted with SSE-S3 before replication can succeed.

Answer

The destination bucket must use the same KMS key as the source; replicate to a multi-Region key or reuse CMK-A in eu-west-1.

Answer

KMS keys cannot be used across Regions, so the destination bucket must disable encryption entirely for replication to work.