S3 buckets should have cross-region replication enabled

A single-region S3 bucket is a single point of failure for data availability. Regional outages, while rare, do happen. Cross-region replication copies new object versions to a bucket in a separate region, giving you a warm standby that supports recovery time objectives measured in minutes rather than hours.

CRR can support regulatory expectations for geographically separated backups. Without it, restoring data after a regional event depends on backup and recovery mechanisms you may or may not have configured.

Implementation

Choose the approach that matches how you manage Terraform.

module "s3_bucket" {
  source  = "soc2.compliance.tf/terraform-aws-modules/s3-bucket/aws"
  version = ">=5.0.0"

  bucket = "abc123"
}

module "s3_bucket" {
  source  = "pcidss.compliance.tf/terraform-aws-modules/s3-bucket/aws"
  version = ">=5.0.0"

  bucket = "abc123"
}

module "s3_bucket" {
  source  = "hipaa.compliance.tf/terraform-aws-modules/s3-bucket/aws"
  version = ">=5.0.0"

  bucket = "abc123"
}

module "s3_bucket" {
  source  = "nist80053.compliance.tf/terraform-aws-modules/s3-bucket/aws"
  version = ">=5.0.0"

  bucket = "abc123"
}

module "s3_bucket" {
  source  = "nistcsf.compliance.tf/terraform-aws-modules/s3-bucket/aws"
  version = ">=5.0.0"

  bucket = "abc123"
}

module "s3_bucket" {
  source  = "fedrampmoderate.compliance.tf/terraform-aws-modules/s3-bucket/aws"
  version = ">=5.0.0"

  bucket = "abc123"
}

module "s3_bucket" {
  source  = "cisv80ig1.compliance.tf/terraform-aws-modules/s3-bucket/aws"
  version = ">=5.0.0"

  bucket = "abc123"
}

module "s3_bucket" {
  source  = "nist800171.compliance.tf/terraform-aws-modules/s3-bucket/aws"
  version = ">=5.0.0"

  bucket = "abc123"
}

module "s3_bucket" {
  source  = "cisacyberessentials.compliance.tf/terraform-aws-modules/s3-bucket/aws"
  version = ">=5.0.0"

  bucket = "abc123"
}

module "s3_bucket" {
  source  = "nydfs23.compliance.tf/terraform-aws-modules/s3-bucket/aws"
  version = ">=5.0.0"

  bucket = "abc123"
}

module "s3_bucket" {
  source  = "ffiec.compliance.tf/terraform-aws-modules/s3-bucket/aws"
  version = ">=5.0.0"

  bucket = "abc123"
}

module "s3_bucket" {
  source  = "eugmpannex11.compliance.tf/terraform-aws-modules/s3-bucket/aws"
  version = ">=5.0.0"

  bucket = "abc123"
}

module "s3_bucket" {
  source  = "cfrpart11.compliance.tf/terraform-aws-modules/s3-bucket/aws"
  version = ">=5.0.0"

  bucket = "abc123"
}

module "s3_bucket" {
  source  = "rbicybersecurity.compliance.tf/terraform-aws-modules/s3-bucket/aws"
  version = ">=5.0.0"

  bucket = "abc123"
}

module "s3_bucket" {
  source  = "rbiitfnbfc.compliance.tf/terraform-aws-modules/s3-bucket/aws"
  version = ">=5.0.0"

  bucket = "abc123"
}

module "s3_bucket" {
  source  = "fedramplow.compliance.tf/terraform-aws-modules/s3-bucket/aws"
  version = ">=5.0.0"

  bucket = "abc123"
}

module "s3_bucket" {
  source  = "hipaasecurity2003.compliance.tf/terraform-aws-modules/s3-bucket/aws"
  version = ">=5.0.0"

  bucket = "abc123"
}

module "s3_bucket" {
  source  = "nistcsfv11.compliance.tf/terraform-aws-modules/s3-bucket/aws"
  version = ">=5.0.0"

  bucket = "abc123"
}

module "s3_bucket" {
  source  = "nist80053rev4.compliance.tf/terraform-aws-modules/s3-bucket/aws"
  version = ">=5.0.0"

  bucket = "abc123"
}

module "s3_bucket" {
  source  = "pcidssv321.compliance.tf/terraform-aws-modules/s3-bucket/aws"
  version = ">=5.0.0"

  bucket = "abc123"
}

module "s3_bucket" {
  source  = "terraform-aws-modules/s3-bucket/aws"
  version = ">=5.0.0"

  bucket = "abc123"

  replication_configuration = {
    rules[0] = {
      status = "Enabled"
    }
  }
}

resource "aws_s3_bucket" "this" {
  bucket        = "pofix-abc123"
  force_destroy = true
}

resource "aws_s3_bucket_replication_configuration" "this" {
  bucket = "example-bucket-abc123"
  role   = "arn:aws:iam::123456789012:role/example-role"

  rule {
    delete_marker_replication {
      status = "Enabled"
    }

    destination {
      bucket        = "arn:aws:s3:::example-bucket-abc123"
      storage_class = "STANDARD"
    }

    filter {
    }

    id       = "cross-region-replication"
    priority = 10
    status   = "Enabled"
  }
}

What this control checks

The policy checks that an aws_s3_bucket_replication_configuration resource is associated with each S3 bucket and that at least one replication rule is active.

To pass, three things must be in place. First, versioning must be enabled on both source and destination buckets via aws_s3_bucket_versioning with versioning_configuration { status = "Enabled" }. Second, an aws_iam_role must exist with a trust policy allowing s3.amazonaws.com to assume it and an attached policy granting s3:GetReplicationConfiguration, s3:ListBucket, s3:GetObjectVersionForReplication, s3:GetObjectVersionAcl, s3:GetObjectVersionTagging on the source and s3:ReplicateObject, s3:ReplicateDelete, s3:ReplicateTags on the destination. Third, the aws_s3_bucket_replication_configuration resource must reference the source bucket via bucket, the IAM role via role, and include at least one rule block with status = "Enabled" and a destination block pointing to a bucket ARN in a different region. A filter block (even if empty) is required in current provider versions. Buckets with no replication configuration, or with all rules set to status = "Disabled", fail.

Common pitfalls

Audit evidence

An auditor expects Config rule evaluation results showing s3-bucket-replication-enabled as COMPLIANT for every in-scope bucket. Supporting evidence includes the S3 console Replication tab showing active rules with a destination bucket in a different region, and replication metrics confirming objects are being replicated successfully. CloudTrail logs for PutBucketReplication calls show when CRR was configured and by whom.

For ongoing assurance, Config conformance pack reports or Security Hub findings exported to a compliance dashboard give continuous coverage. If S3 Batch Replication was used to backfill existing objects, retain the Batch Operations job completion report as well.

Related controls

• Neptune DB clusters should have automated backups enabled

• S3 buckets should have policies that prohibit public access

Tool mappings

Use these identifiers to cross-reference this control across tools, reports, and evidence.

• Compliance.tf Control: s3_bucket_cross_region_replication_enabled

• AWS Config Managed Rule: S3_BUCKET_CROSS_REGION_REPLICATION_ENABLED

• Checkov Check: CKV_AWS_144

• Powerpipe Control: aws_compliance.control.s3_bucket_cross_region_replication_enabled

• Prowler Check: s3_bucket_cross_region_replication

• AWS Security Hub Control: S3.7

Last reviewed: 2026-03-09