S3 general purpose buckets should use cross-Region replication

How to fix it

• Overwrites existing settings: The CLI and Terraform routes replace the bucket's whole replication configuration, so include the rules it already has, or they are deleted.
• Affects another check: Turning on versioning for replication clears S3.14 on both buckets and brings them into S3.10, which fails on any without an enabled lifecycle rule.

In the console

S3 → the bucket → Management → Replication rules

Status

Enabled; a disabled rule does not count

Source bucket

Apply to all objects in the bucket, as AWS advises; a prefix or tag filter also passes this check

Destination

A bucket in another Region; both buckets need Bucket Versioning enabled

IAM role

Create new role, so S3 generates the replication permissions for these two buckets

Replicate existing objects?

Yes, replicate existing objects: the rule itself copies only objects written after it is saved

With the AWS CLI

aws s3api put-bucket-replication --bucket <bucket-name> --replication-configuration file://replication.json

With Terraform

resource "aws_s3_bucket_replication_configuration" "this" {
  bucket = var.bucket_name
  role   = var.replication_role_arn

  rule {
    id     = "cross-region"
    status = "Enabled"

    destination {
      bucket = var.destination_bucket_arn
    }
  }
}