[needs love] feat(@aws-cdk/s3): add support for bucket replication.#184
[needs love] feat(@aws-cdk/s3): add support for bucket replication.#184
Conversation
You can now call `source.enableBucketReplication(dest)` to replicate one bucket to a different one. Note that the two buckets must live in different regions.
| * Can specify details about prefixes to replicate by giving rules. If no rules are given, | ||
| * all objects are replicated with default settings. | ||
| * | ||
| * Note that the indicated bucket MUST reside in a different region! Bucket replication |
| /** | ||
| * Establish bidirectional grant between identity and KMS key for the given actions. | ||
| * | ||
| * Normally we can do it one way, but for KMS keys we must add the grants on |
|
This PR is still broken in the face of encryption. The Console lets me pick a Source key for decryption, but the model doesn't have that field. The Console lets me pick a Destination key, but in CDK it has to be an alias, which I can put but doesn't show in the console? And then there are permissions which are tricky to get right. Policy permissions must be cross-stack, given on the key. However, keys ALWAYS have a generated ID, so we have no solution for this. Aliases have fixed names, but we cannot give permissions on aliases. |
|
A policy like the following on the key will work and I think doesn't compromise too much: |
|
Parking this for later, needs some work but it's not high prio. |
Incorporate progressing insight on how bucket replication works in combination with encryption. - KMS-encrypted objects require a KMS key during the replication operation. - The IAM role must have permissions to use this KMS key (which must be set bidirectionally). Still work left to do, parking for now.
|
This PR will be a great motivating example for cross-stack references. |
|
What's the follow up on this? |
|
Cross stack references first, then this. Still percolating in the back of my head, will start working on it as soon as I have time. |
|
@rix0rrr -- bucket replication is cross region, cross stack references are in region? Is there something to make all that work here? |
|
Not yet, but there will be 😊 |
|
@rix0rrr what should we do with this? |
|
Opened #1680 |
You can now call
source.enableBucketReplication(dest)to replicateone bucket to a different one.
Note that the two buckets must live in different regions.
By submitting this pull request, I confirm that my contribution is made under
the terms of the beta license.