Optional ReadonlyinboundReceiving side. MDAA grants an externally-owned replication role permission to replicate into this bucket. No replication rules and no replication role are created here, because replication rules always live on the sending bucket.
Use cases: Receiving replicas from a non-MDAA source bucket; Completing the receiving end of an MDAA-to-MDAA pair
AWS: S3 bucket policy statements and a KMS key policy grant
Validation: Optional; sourceReplicationRoleArn required when set
Optional ReadonlyoutboundSending side. MDAA creates the replication rules and an MDAA-managed replication role on this bucket, so matching objects written here are copied to a bucket in another account.
Use cases: Replicating a data lake zone into a DR account; Publishing curated data to a consumer account
AWS: S3 ReplicationConfiguration and an IAM replication role
Validation: Optional; when set, destinationBucketArn, destinationAccount, destinationRegion and destinationKmsKeyArn are all required
Cross-account S3 replication for a data lake bucket. The sending side (
outbound) and the receiving side (inbound) are independent and both default off, so an MDAA bucket can send, receive, or do both. Set only the side(s) MDAA manages; when the bucket at the other end is not managed by MDAA, wiring that end up remains the user's responsibility.Use cases: Cross-account DR copies; Sharing curated data with a consumer account; Data residency; Multi-account aggregation
AWS: S3 ReplicationConfiguration, S3 bucket policy, IAM replication role, KMS key policy
Validation: Optional; set outbound, inbound, or both