不同AWS账户S3跨区域复制配置正常但未生效，求助排查

问题背景 #

尝试在不同AWS账户和区域的两个S3桶间配置跨区域复制，但复制未执行，CloudTrail中无相关错误，复制状态指标也无异常。

环境信息 #

• 源桶：Account A所属的source-bucket-name（us-east-1区域）
• 目标桶：Account B所属的destination-bucket-name（us-west-2区域）
• 复制角色：Account A中定义的replication-role-name，已在复制配置中引用
• 两个桶均使用SSE-KMS加密
• 源桶已启用Object Lock

已配置策略 #

IAM角色信任策略（Account A） #

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "s3.amazonaws.com"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "aws:SourceAccount": "ACCOUNT_A_ID"
        },
        "ArnLike": {
          "aws:SourceArn": "arn:aws:s3:::source-bucket-name"
        }
      }
    },
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "s3.amazonaws.com"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "aws:SourceAccount": "ACCOUNT_B_ID"
        },
        "ArnLike": {
          "aws:SourceArn": "arn:aws:s3:::destination-bucket-name"
        }
      }
    }
  ]
}

IAM角色内联策略（Account A） #

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": [
        "s3:GetObject",
        "s3:GetObjectVersion",
        "s3:GetObjectVersionAcl",
        "s3:GetObjectVersionTagging",
        "s3:GetObjectRetention",
        "s3:GetObjectLegalHold",
        "s3:ListBucket"
      ],
      "Effect": "Allow",
      "Resource": [
        "arn:aws:s3:::source-bucket-name",
        "arn:aws:s3:::source-bucket-name/*"
      ]
    },
    {
      "Action": [
        "s3:ReplicateObject",
        "s3:ReplicateDelete",
        "s3:ReplicateTags"
      ],
      "Effect": "Allow",
      "Resource": [
        "arn:aws:s3:::destination-bucket-name",
        "arn:aws:s3:::destination-bucket-name/*"
      ]
    },
    {
      "Action": [
        "kms:Decrypt",
        "kms:ReEncryptFrom"
      ],
      "Effect": "Allow",
      "Resource": "arn:aws:kms:us-east-1:ACCOUNT_A_ID:key/source-kms-key-id"
    },
    {
      "Action": [
        "kms:Encrypt",
        "kms:ReEncryptTo"
      ],
      "Effect": "Allow",
      "Resource": "arn:aws:kms:us-west-2:ACCOUNT_B_ID:key/destination-kms-key-id"
    }
  ]
}

源桶策略（Account A） #

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyInsecureTransport",
      "Effect": "Deny",
      "Principal": "*",
      "Action": "s3:*",
      "Resource": [
        "arn:aws:s3:::source-bucket-name",
        "arn:aws:s3:::source-bucket-name/*"
      ],
      "Condition": {
        "Bool": {
          "aws:SecureTransport": "false"
        }
      }
    },
    {
      "Sid": "AllowReplicationRoleAccess",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::ACCOUNT_A_ID:role/replication-role-name"
      },
      "Action": [
        "s3:GetObjectVersion",
        "s3:GetObjectVersionAcl",
        "s3:GetObjectVersionTagging",
        "s3:ListBucket",
        "s3:GetReplicationConfiguration"
      ],
      "Resource": [
        "arn:aws:s3:::source-bucket-name",
        "arn:aws:s3:::source-bucket-name/*"
      ]
    }
  ]
}

目标桶策略（Account B） #

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowReplicationFromSourceAccount",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::ACCOUNT_A_ID:root"
      },
      "Action": [
        "s3:ReplicateObject",
        "s3:ReplicateDelete",
        "s3:ReplicateTags",
        "s3:ObjectOwnerOverrideToBucketOwner"
      ],
      "Resource": [
        "arn:aws:s3:::destination-bucket-name",
        "arn:aws:s3:::destination-bucket-name/*"
      ]
    }
  ]
}

已验证项 #

• 复制配置正确引用IAM角色
• 双区域KMS加解密权限已配置
• 已授予Object Lock对应权限
• 两桶均开启版本控制与复制功能
• 无额外拒绝策略干扰

补充：复制配置尝试使用目标KMS密钥。

排查思路 #

1. 复制配置范围与触发规则检查
   • 确认复制配置是否覆盖需要复制的对象前缀/标签，默认仅复制配置生效后的新对象，若需复制历史对象需手动开启"复制现有对象"选项
   • 查看源桶对象的x-amz-replication-status元数据，若为SKIPPED需核对是否符合配置中的排除规则（如特定前缀、标签或存储类）
2. KMS密钥双向权限验证
   • 检查Account B的目标KMS密钥策略，需明确允许Account A的复制角色ARN执行kms:Encrypt和kms:ReEncryptTo操作
   • 确认Account A的源KMS密钥策略未限制S3服务或复制角色的kms:Decrypt/kms:ReEncryptFrom权限
3. IAM角色信任策略精简
   • 复制角色仅需允许S3服务从源桶所在账户/ARN AssumeRole，目标桶对应的信任条目属于冗余配置，可移除后测试
4. 目标桶权限精准化
   • 将目标桶策略中的Principal从Account A的root用户改为复制角色的ARN，缩小权限范围同时确保授权精准
5. Object Lock与版本控制联动验证
   • 再次确认源桶的Object Lock配置未导致对象处于不可复制状态，比如保留期内对象的权限是否完全覆盖（已包含GetObjectRetention/GetObjectLegalHold，可核对是否应用到所有对象版本）
6. S3复制配置深度验证
   • 使用AWS CLI执行aws s3api get-bucket-replication --bucket source-bucket-name，确认配置参数（如目标桶ARN、角色ARN、KMS密钥）完全正确
   • 查看源桶控制台的"复制"选项卡，检查是否有未显示的配置警告或状态异常
7. CloudTrail事件多区域筛选
   • 同时在源区域（us-east-1）和目标区域（us-west-2）的CloudTrail中筛选事件源为s3.amazonaws.com、事件名称包含Replicate或PutObject的日志，复制请求可能在目标区域产生事件
8. 网络访问限制排查
   • 若源桶通过VPC端点访问，需确认VPC端点策略允许S3跨区域访问目标桶和对应KMS服务，无防火墙或安全组限制

内容的提问来源于stack exchange，提问作者jipot