Question

A financial services company must replicate objects from a production S3 bucket in us-east-1 to a disaster-recovery bucket in eu-west-1. Compliance requires that replicated data be encrypted in transit, that most objects arrive at the destination within a predictable, contractually enforceable time window, and that replication metrics be visible for auditing. The source bucket already uses SSE-KMS with a customer managed key. Which approach best satisfies ALL of these requirements?

Accepted Answer

Enable S3 Cross-Region Replication with S3 Replication Time Control (S3 RTC), configure the destination KMS key in the replication rule, and rely on S3's TLS-secured replication traffic while monitoring the provided CloudWatch replication metrics.

Answer

Enable standard S3 Cross-Region Replication without RTC, and create a Lambda function triggered on ObjectCreated events to copy each object over an IPsec VPN tunnel to the destination bucket.

Answer

Use S3 Batch Operations on a daily schedule to copy new objects to the destination bucket, enforcing HTTPS with a bucket policy aws:SecureTransport condition.

Answer

Enable S3 Same-Region Replication with RTC in us-east-1, then use AWS DataSync to move the replica to eu-west-1 on a nightly schedule to guarantee the delivery window.