AWS AmazonS3 documentation change
Summary
Added documentation about interaction between S3 Lifecycle and replication, explaining that Lifecycle blocks actions on objects with PENDING or FAILED replication status.
Security assessment
The change documents data management behavior between Lifecycle and replication features. It explains how objects with failed replication status are handled and the need for manual intervention via S3 Batch Replication. While this has data integrity implications, it does not address security vulnerabilities or add security-specific documentation.
Diff
diff --git a/AmazonS3/latest/userguide/lifecycle-and-other-bucket-config.md b/AmazonS3/latest/userguide/lifecycle-and-other-bucket-config.md index ce8e456d7..4a9d142e4 100644 --- a//AmazonS3/latest/userguide/lifecycle-and-other-bucket-config.md +++ b//AmazonS3/latest/userguide/lifecycle-and-other-bucket-config.md @@ -5 +5 @@ -S3 Lifecycle and S3 VersioningS3 Lifecycle configuration on MFA-enabled bucketsS3 Lifecycle and logging +S3 Lifecycle and S3 VersioningS3 Lifecycle andS3 Lifecycle configuration on MFA-enabled bucketsS3 Lifecycle and logging @@ -33,0 +34,8 @@ For examples, see [Examples of overlapping filters and conflicting lifecycle act +## S3 Lifecycle and + +When you have both and S3 Lifecycle enabled on a bucket, S3 Lifecycle blocks expiration and transition actions on objects with `PENDING` or `FAILED` replication status. This ensures that Lifecycle does not act on objects until they have successfully replicated to their destination bucket. + +Objects transition to a `FAILED` replication state for issues such as missing replication role permissions, AWS Key Management Service (AWS KMS) permissions, or bucket permissions. For more information, see [Troubleshooting replication](./replication-troubleshoot.html). + +Objects with `FAILED` replication status will continue to incur storage costs past their Lifecycle expiration or transition eligibility date until the replication issue is resolved. Once you fix the underlying replication configuration or IAM permissions, new objects will replicate automatically. However, objects that already have `FAILED` replication status will not automatically retry—you must use S3 Batch Replication to replicate them, or delete them using S3 Batch Operations with AWS Lambda if no longer needed. After objects successfully replicate (or are deleted), Lifecycle will resume processing them according to your configured rules. To identify objects with `FAILED` replication status, you can use Amazon CloudWatch metrics (`OperationFailedReplication`) to monitor failure counts and trends at the bucket level, or use Amazon S3 Inventory reports, Amazon S3 API (`HeadObject` or `GetObject`), or Amazon S3 Event Notifications for object-level details. +