AWS AmazonS3 documentation change
Summary
Added documentation for replicating object annotations including required IAM permissions, replication behavior, and how to block annotation replication using bucket policies.
Security assessment
The change documents security controls (IAM permissions and bucket policies) for annotation replication but doesn't address a specific vulnerability. It explains how to properly configure permissions for annotation replication and how to block it if needed.
Diff
diff --git a/AmazonS3/latest/userguide/replication-example-walkthroughs.md b/AmazonS3/latest/userguide/replication-example-walkthroughs.md index be1bea01d..eb76e098d 100644 --- a//AmazonS3/latest/userguide/replication-example-walkthroughs.md +++ b//AmazonS3/latest/userguide/replication-example-walkthroughs.md @@ -6,0 +7,2 @@ +Replicating annotations + @@ -45,0 +48,40 @@ For a step-by-step tutorial that demonstrates how to use live replication to rep + * Replicating annotations + + + + +## Replicating annotations + +When you configure replication on a bucket, Amazon S3 replicates annotations automatically as part of live replication. Each annotation replicates independently as changes occur. To replicate annotations, the replication IAM role must include the `s3:GetObjectVersionAnnotationForReplication` permission on the source bucket. + +The following example shows the source bucket statement in the IAM role permissions policy with the annotation replication permission included: + + + { + "Effect": "Allow", + "Action": [ + "s3:GetObjectVersionForReplication", + "s3:GetObjectVersionAcl", + "s3:GetObjectVersionTagging", + "s3:GetObjectVersionAnnotationForReplication" + ], + "Resource": [ + "arn:aws:s3:::amzn-s3-demo-source-bucket/*" + ] + } + +No additional destination bucket permissions are required for annotation replication. The `s3:ReplicateObject` permission on the destination bucket covers annotation replication. + +Note the following behaviors for annotation replication: + + * Annotation additions and updates on the source are replicated to the destination. Each annotation replicates independently as changes occur. + + * Annotation deletions on the source are not replicated to the destination. If you delete an annotation on the source, the annotation persists on the destination. + + * If you repeatedly delete and recreate annotations on the source with different names, annotations accumulate on the destination over time because deletions are not replicated. + + + + +If you don't want annotations to replicate to a destination bucket, the destination bucket owner can add a Deny statement for the `s3:ReplicateObjectAnnotation` action to the destination bucket policy. Object replication continues to succeed; only annotation replication is blocked. The following example shows the Deny statement: + @@ -46,0 +89,12 @@ For a step-by-step tutorial that demonstrates how to use live replication to rep + ... + "Statement":[ + { + "Effect":"Deny", + "Principal":{ + "AWS":"arn:aws:iam::source-bucket-account-id:role/service-role/source-account-IAM-role" + }, + "Action":"s3:ReplicateObjectAnnotation", + "Resource":"arn:aws:s3:::amzn-s3-demo-destination-bucket/*" + } + ] + ... @@ -47,0 +102 @@ For a step-by-step tutorial that demonstrates how to use live replication to rep +For more information about annotation replication behavior, see [What does Amazon S3 replicate?](./replication-what-is-isnot-replicated.html). For permission setup instructions, see [Setting up permissions for live replication](./setting-repl-config-perm-overview.html).