S3 Server Access Logging - Cross-Account for encrypted objects

Question

Dear community,

Requesting your support.

**Situation: **  
* We do have a multi-account setup with a centralized logging account
* We need to write S3 Server Access Logs from a decentral Account D to the central Account C
* Objects in decentral Accound D are encrypted - this must be Amazon Managed Key because S3 Server Access Logs are not compatible with Customer Managed Keys acc. to AWS documentation
* Unfortunately Amazon Managed Keys cannot be shared cross-account, because one cannot define its policies

**Target:  **  
* We want to decrypt the files in decentral Account D using its Amazon Managed Key and write S3 Server Access Logs in a dedicated bucket in same account
* Then we replicate objects to Central Account C, and reencrypt with a Customer Managed Key from Central Account C - this seems technically not possible

**Error Message:  **  
"You don’t have permission to get the server-side encryption settings
After you or your AWS administrator has updated your permissions to allow the s3:GetObject action, refresh the page. "

**Any ideas?**  
(update: I added a comment below with additional context - see my response to Osvaldo)

Andre · Accepted Answer

Update: I was able to fix it myself.

Root cause: The Replication Destination was misconfigured. Using Terraform the destination bucket was set up as if in the same account. Changing the Replication Destination to "specify a bucket in another account" fixed the issue. This is still strange, because object were replicated using the "choose bucket in this account" using a bucket name from a different account. However, it is fixed. Thanks for your help!

Additional note: You can simply keep the Amazon Managed Key setting for encryption. Using the option "change object ownership to destination bucket owner" uses the destination Amazon Managed Key. No need to use Customer Managed Key in this case.

Osvaldo Marte · Answer

To replicate S3 Server Access Logs from Account D to Account C with encryption requirements, follow these steps:

1. **In Account D:**
   - Enable S3 Server Access Logging to a specific bucket.
   - Set a bucket policy allowing cross-account access from Account C for `s3:GetObject` and `s3:ReplicateObject`.

2. **In Account C:**
   - Create a Customer Managed Key (CMK) in KMS for encryption.
   - Configure S3 replication to copy logs from Account D to C, encrypting with the CMK in Account C.
   - Create an IAM role with permissions for replication and encryption (`s3:ReplicateObject`, `s3:ReplicateDelete`, `kms:Encrypt`), accessible by Account D.

3. **Troubleshooting:**
   - Ensure roles/users in both accounts have the necessary permissions (`s3:GetObject`, `kms:Decrypt`, `s3:GetEncryptionConfiguration`).

S3 Server Access Logging - Cross-Account for encrypted objects

Relevant content