配置跨区域复制S3加密对象的源KMS密钥技术咨询

我来帮你搞定这个S3跨区域复制的Terraform配置问题！当源对象用KMS加密时，你得在复制规则里明确指定用于解密的KMS密钥，同时确保IAM复制角色有对应的权限才行。下面是完整的配置示例和关键要点：

# 源S3桶（需开启版本控制）
resource "aws_s3_bucket" "source_bucket" {
  bucket = "your-source-bucket-name"

  versioning {
    enabled = true
  }
}

# 目标复制S3桶（需开启版本控制）
resource "aws_s3_bucket" "replication_bucket" {
  bucket = "your-replication-bucket-name"

  versioning {
    enabled = true
  }
}

# 源对象加密用的KMS密钥（假设已存在）
data "aws_kms_key" "source_kms_key" {
  key_id = "arn:aws:kms:us-east-1:123456789012:key/abc123-xyz456"
}

# 可选：目标区域用于加密副本的KMS密钥
data "aws_kms_key" "dest_kms_key" {
  key_id = "arn:aws:kms:us-west-2:123456789012:key/def789-ghi012"
}

# 复制专用IAM角色
resource "aws_iam_role" "replication" {
  name = "s3-replication-role"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = "sts:AssumeRole"
        Effect = "Allow"
        Principal = {
          Service = "s3.amazonaws.com"
        }
      }
    ]
  })
}

# 角色权限策略
resource "aws_iam_role_policy" "replication_permissions" {
  name = "s3-replication-permissions"
  role = aws_iam_role.replication.id

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      # 源桶必要权限
      {
        Action = [
          "s3:GetReplicationConfiguration",
          "s3:ListBucket",
          "s3:GetObjectVersion",
          "s3:GetObjectVersionAcl"
        ]
        Effect = "Allow"
        Resource = [
          aws_s3_bucket.source_bucket.arn,
          "${aws_s3_bucket.source_bucket.arn}/*"
        ]
      },
      # 目标桶必要权限
      {
        Action = [
          "s3:ReplicateObject",
          "s3:ReplicateDelete",
          "s3:ReplicateTags",
          "s3:PutObjectVersionAcl"
        ]
        Effect = "Allow"
        Resource = "${aws_s3_bucket.replication_bucket.arn}/*"
      },
      # 源KMS密钥解密权限
      {
        Action = "kms:Decrypt"
        Effect = "Allow"
        Resource = data.aws_kms_key.source_kms_key.arn
      },
      # 可选：目标KMS密钥加密权限（如果副本要加密）
      {
        Action = [
          "kms:Encrypt",
          "kms:GenerateDataKey*"
        ]
        Effect = "Allow"
        Resource = data.aws_kms_key.dest_kms_key.arn
      }
    ]
  })
}

# 源桶的复制核心配置
resource "aws_s3_bucket_replication_configuration" "source_replication" {
  bucket = aws_s3_bucket.source_bucket.id
  role   = aws_iam_role.replication.arn

  rules {
    id       = var.service
    prefix   = var.replication_bucket_prefix
    status   = "Enabled"

    # 指定解密源对象的KMS密钥
    source_selection_criteria {
      sse_kms_encrypted_objects {
        enabled = true

        kms_key_ids = [
          data.aws_kms_key.source_kms_key.arn
          # 若源桶对象用了多个KMS密钥，全部列在这里
        ]
      }
    }

    destination {
      bucket        = aws_s3_bucket.replication_bucket.arn
      storage_class = "STANDARD"

      # 可选：配置副本的加密方式
      encryption_configuration {
        replica_kms_key_id = data.aws_kms_key.dest_kms_key.arn
      }
    }
  }
}

• source_selection_criteria 块：这是处理KMS加密对象复制的核心，必须开启sse_kms_encrypted_objects.enabled = true，并在kms_key_ids中列出所有加密源对象的KMS密钥ARN，支持多个密钥。
• IAM角色权限：复制角色需要具备源桶的读取权限、目标桶的写入权限，最重要的是对源KMS密钥有kms:Decrypt权限（才能解密源对象）；如果目标副本也要用KMS加密，还需对目标KMS密钥有kms:Encrypt和kms:GenerateDataKey*权限。
• KMS密钥策略：别忘了给源和目标KMS密钥的密钥策略添加允许复制角色访问的语句，比如：

  {
    "Effect": "Allow",
    "Principal": {
      "AWS": "arn:aws:iam::123456789012:role/s3-replication-role"
    },
    "Action": ["kms:Decrypt"],
    "Resource": "*"
  }
  

• 版本控制要求：S3跨区域复制强制要求源桶和目标桶都开启版本控制，上面的配置已经包含了这部分。

内容的提问来源于stack exchange，提问作者Thomas Larsen