So now let's talk about
S3 replication and its relation to encrypted objects.
So if you enable S3 replication from one bucket to another,
then any unencrypted object and objects encrypted
with SSE-S3 will be replicated by default.
If you do happen to encrypt an object with SSE-C
where it's a customer provided key,
they will never be replicated because you would need to
provide the key all the time and that doesn't work.
And then we have objects encrypted with SSE-KMS.
So by default, they're not replicated,
but we need to enable the option to actually
replicate these objects.
And so we specify with which KMS key we want to
encrypt the objects within the target bucket.
And then we adapt this KMS key policy for the target key.
And we create an IAM role that is allowing
the S3 replication service to first decrypt the data
in the source bucket.
And then re-encrypt the data in the target bucket
with the target KMS key.
And so when you do so this enables replication because
there is a lot of encryption and decryption happening.
You may get KMS throttling errors in which case
you need to ask for a service quotas.
So a question you may have is, "Should I use multi-region
key with S3 replication?"
And the documentation says that you can use
multi-region key for S3 replication,
but currently they are treated as independent keys
by the Amazon S3 service and therefore,
the object is still going to be decrypted and then encrypted
using the same key even though the key
is a multi-region key, okay?
So this is it for this lecture.
I hope you liked it.
And I will see you in the next lecture.