Optional ReadonlydeleteReplicate delete markers, so a delete here also hides the object at the destination. Off by default, leaving the replica in place so the destination survives a delete at the source.
Use cases: Mirroring deletions to a consumer account; Keeping a DR copy that survives a source delete
AWS: S3 ReplicationRule DeleteMarkerReplication
Validation: Optional; when true the replication role is also granted s3:ReplicateDelete
ReadonlydestinationAWS account ID owning the destination bucket. Required because S3 bucket ARNs contain no account ID, and S3 needs it to confirm destination ownership.
Use cases: Cross-account replication; Destination ownership verification
AWS: S3 ReplicationRule Destination.Account
Validation: Required; 12-digit AWS account ID
ReadonlydestinationARN of the destination bucket receiving the replicas. The bucket must exist and have versioning enabled; MDAA does not create it.
Use cases: Targeting a DR bucket; Targeting a partner account's bucket
AWS: S3 ReplicationRule Destination.Bucket
Validation: Required; S3 bucket ARN, e.g. arn:aws:s3:::my-dr-bucket
ReadonlydestinationCustomer managed KMS key encrypting the replicas, in the destination account and region. Required, not optional: S3 does not replicate SSE-KMS encrypted objects unless the rule names a replica key, and MDAA source buckets always encrypt with a CMK. AWS managed keys cannot be used, as they do not permit cross-account use.
Use cases: Re-encrypting replicas under a destination-owned key
AWS: S3 ReplicationRule Destination.EncryptionConfiguration.ReplicaKmsKeyID
Validation: Required; KMS key ARN whose region matches destinationRegion
ReadonlydestinationRegion of the destination bucket. Used to scope the replication role's KMS grants to S3 in that region, and to check destinationKmsKeyArn is a key in the same region.
Use cases: Cross-region DR; Data residency
AWS: kms:ViaService condition on the replication role's destination key grant
Validation: Required; AWS region name, e.g. us-west-2
Optional ReadonlyprefixS3 prefixes to replicate, one replication rule per entry. Omit to replicate the whole bucket, which is usually what a DR copy wants.
Use cases: Replicating only /data while leaving scratch prefixes local; Whole-bucket DR
AWS: S3 ReplicationRule Filter.Prefix
Validation: Optional; array of S3 prefixes
Optional ReadonlyreplicationExisting role S3 assumes to replicate out of this bucket, instead of MDAA creating one. Needed when the destination is another data lake in the same MDAA config: the destination names this role in its policies and deploys first, so it cannot be a role this stack creates. Must be in this bucket's account and assumable by s3.amazonaws.com; MDAA attaches the replication permissions as a managed policy.
Use cases: Replicating between two MDAA deployments in one config; Reusing a centrally managed replication role
AWS: S3 ReplicationConfiguration Role
Validation: Optional; must resolve to a role ARN in this account
Sending-side replication settings. Every field except prefixFilters is required: an S3 bucket ARN carries neither account nor region, and because MDAA buckets always encrypt with a CMK, S3 replicates nothing unless a destination replica key is supplied.
Use cases: Cross-account DR; Cross-region DR; Publishing data to a consumer account
AWS: S3 ReplicationConfiguration rules and an IAM replication role
Validation: destinationBucketArn, destinationAccount, destinationRegion and destinationKmsKeyArn required; destinationKmsKeyArn must be a customer managed key in destinationRegion