How do I automate S3 cross-region replication with Pulumi?

Automating S3 Cross-Region Replication with Pulumi

In this guide, we’ll set up cross-region replication between two S3 buckets using Pulumi. Cross-region replication allows you to create a copy of your data in a different AWS region, improving data durability and reducing latency.

Program Explanation

Define the Primary S3 Bucket: The source bucket where data is initially stored.
Define the Replica S3 Bucket: The destination bucket in a different region.
Create an IAM Role for Replication: Required for the S3 service to replicate objects on your behalf.
Attach the Required Policy to the IAM Role: Grants the necessary permissions for replication.
Create a Replication Rule: Defines the criteria and destination for replication from the source bucket to the replica bucket.
Export Outputs: The names of the primary and replica buckets.

Here is the terraform program that implements the above requirements.

import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

const source = new aws.s3.BucketV2("source", {
    bucket: "my-source-bucket",
    acl: "private",
    versionings: [{
        enabled: true,
    }],
});
const destination = new aws.s3.BucketV2("destination", {
    bucket: "my-destination-bucket",
    acl: "private",
    versionings: [{
        enabled: true,
    }],
});
const replicationRole = new aws.iam.Role("replication_role", {
    name: "replication-role",
    assumeRolePolicy: JSON.stringify({
        Version: "2012-10-17",
        Statement: [{
            Action: "sts:AssumeRole",
            Effect: "Allow",
            Principal: {
                Service: "s3.amazonaws.com",
            },
        }],
    }),
});
const replicationPolicy = new aws.iam.RolePolicy("replication_policy", {
    name: "replication-policy",
    role: replicationRole.id,
    policy: pulumi.jsonStringify({
        Version: "2012-10-17",
        Statement: [
            {
                Action: [
                    "s3:GetReplicationConfiguration",
                    "s3:ListBucket",
                ],
                Effect: "Allow",
                Resource: source.arn,
            },
            {
                Action: [
                    "s3:GetObjectVersionForReplication",
                    "s3:GetObjectVersionAcl",
                ],
                Effect: "Allow",
                Resource: pulumi.interpolate`${source.arn}/*`,
            },
            {
                Action: [
                    "s3:ReplicateObject",
                    "s3:ReplicateDelete",
                ],
                Effect: "Allow",
                Resource: pulumi.interpolate`${destination.arn}/*`,
            },
        ],
    }),
});
const replication = new aws.s3.BucketReplicationConfig("replication", {
    bucket: source.bucket,
    role: replicationRole.arn,
    rules: [{
        id: "ReplicationRule",
        status: "Enabled",
        destination: {
            bucket: destination.arn,
            storageClass: "STANDARD",
        },
        filter: {
            prefix: "",
        },
    }],
});
export const sourceBucket = source.bucket;
export const destinationBucket = destination.bucket;

Summary

In this program, we defined two S3 buckets in different regions, created an IAM role with necessary permissions for replication, and established a replication configuration rule to enable cross-region replication. The program also includes outputs to visualize the names of the source and destination buckets. This enables automated, continuous syncing of objects from the source to the destination bucket in different AWS regions.

Deploy this code

Want to deploy this code? Sign up for a free Pulumi account to deploy in a few clicks.

New to Pulumi?

Want to deploy this code? Sign up with Pulumi to deploy in a few clicks.