S3 Cross region replication using Terraform
09:24 03 Feb 2020

I was using Terraform to setup S3 buckets (different region) and set up replication between them.

It was working properly until I added KMS in it.

I created 2 KMS keys one for source and one for destination.

Now while applying replication configuration, there is an option to pass destination key for destination bucket but I am not sure how to apply key at the source.

Any help would be appreciated.

provider "aws" {
  alias  = "east"
  region = "us-east-1"
}

resource "aws_s3_bucket" "destination-bucket" {
  bucket = ""destination-bucket"
  provider = "aws.east"
  acl    = "private"
  region   = "us-east-1"
  versioning {
    enabled = true
  }
  server_side_encryption_configuration {
    rule {
      apply_server_side_encryption_by_default {
        kms_master_key_id = "${var.kms_cmk_dest_arn}"
        sse_algorithm     = "aws:kms"
      }
    }
  }
}

resource "aws_s3_bucket" "source-bucket" {
  bucket = "source-bucket"
  acl    = "private"
  versioning {
    enabled = true
  }
  server_side_encryption_configuration {
    rule {
      apply_server_side_encryption_by_default {
        kms_master_key_id = "${var.kms_cmk_arn}"
        sse_algorithm     = "aws:kms"
      }
    }
  }
  replication_configuration {
    role = "${aws_iam_role.replication.arn}"

    rules {
      status = "Enabled"
	  destination {
        bucket        = "${aws_s3_bucket.source-bucket.arn}"
        storage_class = "STANDARD"
		replica_kms_key_id = "${var.kms_cmk_dest_arn}"
      }
	  source_selection_criteria {
      sse_kms_encrypted_objects {
      enabled = true
	  }
    }
    }
  }
}

resource "aws_iam_role" "replication" {
  name = "cdd-iam-role-replication"
  permissions_boundary    = "arn:aws:iam::${var.account_id}:policy/ServiceRoleBoundary"
  assume_role_policy = <

amazon-web-services amazon-s3 encryption terraform replication