Examkin

Question

Difficulty: HardS3 Reliability and Replication

A SysOps Administrator is configuring cross-account Amazon S3 replication from a source bucket in AWS Account A to a destination bucket in AWS Account B. S3 Versioning is enabled on both buckets, and a replication rule is configured with an IAM role in Account A. Although objects successfully replicate to the destination bucket, IAM users in Account B receive an Access Denied error when trying to read the replicated objects because they are still owned by Account A. Which combination of actions must the administrator take to allow Account B's users to access the replicated objects?

  1. Configure the replication rule in Account A to override the replica owner to the destination bucket owner, and update Account B's bucket policy to grant the replication IAM role in Account A the s3:ObjectOwnerOverrideToBucketOwner and s3:ReplicateObject permissions.Answer
  2. B
    Suspend S3 Versioning on the destination bucket in Account B to prevent Account A from maintaining object ownership metadata, and update Account B's bucket policy to grant read access to Account B's users.
  3. C
    Configure the replication rule in Account A to use a new KMS key owned by Account B, and grant the replication IAM role the iam:PassRole permission for Account B's KMS key.
  4. D
    Create an S3 gateway VPC endpoint in Account B's VPC, associate it with the route tables of Account B's IAM users, and add a bucket policy in Account B that permits access only through this endpoint.

Answer

Configure the replication rule in Account A to override the replica owner to the destination bucket owner, and update Account B's bucket policy to grant the replication IAM role in Account A the s3:ObjectOwnerOverrideToBucketOwner and s3:ReplicateObject permissions.
The correct action is to configure the replica owner override option in the replication rule (AccessControlTranslation) and grant the replication IAM role the s3:ObjectOwnerOverrideToBucketOwner permission in both the IAM policy and the destination bucket policy. This transfers ownership of replicated objects to the destination bucket owner, enabling users in Account B to access them.

Step-by-Step Solution

1
Enable replica owner override in the replication configuration.
The replication rule specifies that the replica owner should be translated to the destination bucket owner.
By default, replicated objects in cross-account replication are still owned by the source account, which prevents the destination account's users from accessing them.
2
Modify the destination bucket policy in Account B.
The bucket policy allows the source replication IAM role to perform s3:ObjectOwnerOverrideToBucketOwner.
The replication role requires explicit permission from the destination bucket owner to change the ownership of the replicated objects to the destination bucket owner.
3
Ensure the replication IAM role in Account A has the required permissions.
The role can successfully replicate the objects and perform the owner override action.
The replication role must be allowed to apply the owner override setting during the replication process.

Key Concept

Cross-Account S3 Replication Object Ownership Override
Rate this question

Topics

S3 Reliability and Replication

More questions from this topic