Answers: <p>So I verified it was definitely public access causing the issue somehow; uploading an identical file but with the public read acl on totally broke it.</p>
  
  <p>I worked with AWS support and they noticed I had "Block public access" enabled in the destination bucket.  Apparently rather than replicating the object and then making it private, it just fails replication.</p>
  
  <p>tl;dr if you want to replicate objects that are public read, don't block public read at the destination.</p>
  
Answers: CC BY-SA 4.0
Answers: 2019-06-05T17:08:04.153Z
Answers: 2019-06-05T17:08:04.153Z
Answers: Aaron R.
Body: <p>I've followed the documentation to set up cross-region replication to another AWS account.  It looked like it was working correctly until I noticed an entire prefix was missing.</p>
  
  <p>Here is my destination bucket policy:</p>
  
  <pre><code>{
      "Version": "2008-10-17",
      "Id": "S3-Console-Replication-Policy",
      "Statement": [
          {
              "Sid": "S3ReplicationPolicyStmt1",
              "Effect": "Allow",
              "Principal": {
                  "AWS": "arn:aws:iam::&lt;awsaccount&gt;:root"
              },
              "Action": [
                  "s3:GetBucketVersioning",
                  "s3:PutBucketVersioning",
                  "s3:ReplicateObject",
                  "s3:ReplicateDelete",
                  "s3:ObjectOwnerOverrideToBucketOwner"
              ],
              "Resource": [
                  "arn:aws:s3:::bucket-backup",
                  "arn:aws:s3:::bucket-backup/*"
              ]
          }
      ]
  }
  </code></pre>
  
  <p>Looking further into it, I have also realized this particular prefix is where we store our public-access data, so maybe that's related somehow?</p>
  
Tags: <amazon-web-services><amazon-s3>
Title: Why isn't my S3 Cross Region Replication working for some files?
UserDisplayName: Aaron R.
ThreadText: # Why isn't my S3 Cross Region Replication working for some files?
  
  (Asked by: username_0 on 2019-06-05)
  
  I've followed the documentation to set up cross-region replication to another AWS account. It looked like it was working correctly until I noticed an entire prefix was missing.
  
  Here is my destination bucket policy:
  
  ```
  {
      "Version": "2008-10-17",
      "Id": "S3-Console-Replication-Policy",
      "Statement": [
          {
              "Sid": "S3ReplicationPolicyStmt1",
              "Effect": "Allow",
              "Principal": {
                  "AWS": "arn:aws:iam::<awsaccount>:root"
              },
              "Action": [
                  "s3:GetBucketVersioning",
                  "s3:PutBucketVersioning",
                  "s3:ReplicateObject",
                  "s3:ReplicateDelete",
                  "s3:ObjectOwnerOverrideToBucketOwner"
              ],
              "Resource": [
                  "arn:aws:s3:::bucket-backup",
                  "arn:aws:s3:::bucket-backup/*"
              ]
          }
      ]
  }
  
  ```
  
  Looking further into it, I have also realized this particular prefix is where we store our public-access data, so maybe that's related somehow?
  
  **Tags:** amazon-web-services, amazon-s3
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_0 on 2019-06-05. Score: 2
  
  So I verified it was definitely public access causing the issue somehow; uploading an identical file but with the public read acl on totally broke it.
  
  I worked with AWS support and they noticed I had "Block public access" enabled in the destination bucket. Apparently rather than replicating the object and then making it private, it just fails replication.
  
  tl;dr if you want to replicate objects that are public read, don't block public read at the destination.
  
  
  ---
  
  