SAA-C03
Deep Dive
S3 Replication automatically copies objects between buckets for DR, compliance or reduced latency. Cross-Region Replication (CRR) is key for Disaster Recovery architectures. Same-Region Replication (SRR) aggregates logs or syncs test/prod environments. Versioning is a mandatory prerequisite.
Contents
Versioning keeps every version of an object, including deletions. It is a mandatory prerequisite to enable CRR or SRR on any bucket. Without versioning enabled on both source and destination, replication does not work.
Unversioned (default)
The initial state of every bucket. No previous versions of objects are kept.
Versioning-enabled
Every version of each object is kept. A mandatory prerequisite for CRR and SRR.
Versioning-suspended
Does not create new versions but keeps existing ones. New objects get a version ID of "null".
Delete Marker
When you delete an object with versioning enabled, S3 creates a "delete marker" instead of removing the object. The object still exists and can be recovered by removing the marker.
MFA Delete
An extra layer of security. Requires MFA to permanently delete versions or to change the bucket's versioning state.
Versioning cost
You pay for every version stored. Old versions accumulate cost. Use Lifecycle Rules to automatically expire unwanted versions.
Lifecycle + Versioning
Lifecycle rules can move old versions to cheaper classes (IA, Glacier) or expire them after N days to control costs.
Exam trap
Suspending versioning does not delete existing versions — it only stops creating new ones. Old versions remain and continue to be billed. To remove them, use Lifecycle policies or delete them manually.
CRR automatically replicates objects to a bucket in another AWS region. It's the primary tool for multi-region Disaster Recovery architectures and for meeting data residency requirements in specific geographies.
Use cases
Multi-region DR, reduced latency for users in another region, compliance (data residency in a specific country).
Prerequisites
Versioning enabled on the source and destination bucket. IAM role with s3:ReplicateObject, s3:ReplicateDelete permissions.
Replication Time Control (RTC)
Guarantees 99.99% of objects are replicated within ≤15 minutes. Has additional cost. Without RTC, latency is variable.
Standard CRR vs CRR with RTC
Standard CRR
Replicates objects with no time SLA. Can take anywhere from seconds to minutes (or longer in exceptional cases). No contractual RPO guarantee.
CRR with RTC (Replication Time Control)
Guarantees 99.99% of objects are replicated within ≤15 minutes. Includes replication metrics in CloudWatch. Has additional cost.
Exam trap
Objects that existed before enabling CRR are not replicated automatically. Only new objects (created after the rule is enabled) get replicated. To replicate existing objects, use S3 Batch Replication as an additional manual step.
SRR replicates objects between buckets within the same AWS region. It shares the same prerequisites as CRR (versioning on both buckets) but serves different use cases where inter-regional latency is neither needed nor desirable.
Log aggregation
Consolidate logs from multiple buckets in the same region into a single central bucket for analysis.
Prod to Test
Replicate production data to a separate test environment within the same region, with real data without affecting prod.
Multi-account, same region
Sync buckets between different AWS accounts within the same region. Useful for account segregation with regional compliance.
CRR vs SRR — main difference
The only technical difference is the destination region. CRR = destination bucket in a different region. SRR = destination bucket in the same region. Both require versioning, an IAM role, and have the same configuration options (filters, storage class override, ownership override).
Filters by prefix or tags
You don't have to replicate the entire bucket. You can create rules to replicate only objects with a certain prefix (e.g. "logs/") or specific tags.
Storage class override
Replicated objects can be stored in a different storage class at the destination. Typical: replicate to S3-IA or S3 Glacier for lower-cost DR.
Ownership override
In cross-account replication, the owner of the destination object can be changed to the destination account. Without this, objects belong to the source account.
Replication of encrypted objects
SSE-S3: supported by default. SSE-KMS: requires additional configuration — the destination KMS key must be explicitly configured in the replication rule.
Bucket Replication vs S3 Batch Replication
A Replication Rule covers new objects from the moment it's enabled. Objects that existed before enabling the rule are NOT replicated — use S3 Batch Replication for those.
Exam trap
Delete markers are NOT replicated by default. If the source deletes an object and the destination is expected to also "delete" it (receive the delete marker), you must explicitly enable the "Replicate delete markers" option in the replication rule.
CRR is one of the pillars of a multi-region DR strategy on AWS. Combined with Route 53 Failover Routing and pre-configured compute (Pilot Light), it enables fast recovery from regional failures.
CRR + Route 53 Failover Routing = a solid DR architecture with automated failover
CRR with RTC: guaranteed RPO of ≤15 minutes for 99.99% of objects
Object Lock on the destination bucket: protection against ransomware and accidental deletion
Pilot Light DR: CRR keeps data replicated; on disaster, launch compute in the secondary region
CRR replaces a backup — false. It's synchronous-style replication, not archiving with long-term retention. Use Glacier for backups
RPO with CRR — quick reference
Standard CRR
RPO: minutes (no contractual guarantee). Valid for DR where variable replication latency is acceptable.
CRR + RTC
Guaranteed RPO: ≤15 minutes for 99.99% of objects. Use when the business SLA demands a concrete, documented RPO.
Versioning is mandatory on BOTH buckets (source and destination)
Not just the source. If the destination doesn't have versioning enabled, replication fails. This is one of the most common mistakes on the exam.
Standard CRR does NOT guarantee replication time
Latency is variable — it can be seconds or minutes depending on size and load. Only RTC guarantees ≤15 minutes for 99.99% of objects.
Delete markers are NOT replicated by default
If an object is deleted in the source, the delete marker isn't automatically copied to the destination. It can be configured to replicate, but that's not the default.
S3 Batch Replication for existing objects
When you enable CRR, only new objects are replicated. To migrate objects that existed before, use S3 Batch Replication as a manual operation.
Suspending versioning does not delete existing versions
Previous versions remain and continue to be billed. Only Lifecycle Policies can expire and remove old versions automatically.
Visualizes Cross-Region and Same-Region Replication with their use cases and configuration.
Did you get this topic?
Test what you just learned
A company has critical data in S3 us-east-1. They need that data available in eu-west-1 for DR, with a guarantee that 99.99% of new objects are replicated within 15 minutes. Which configuration is correct?
Put what you learned to the test with original SAA-C03 exam questions.
Start SAA-C03 mock examUnlimited mock exams with the Pro plan
Log in to track your progress.