S3 bucket has cross-region replication configured to a bucket in a different region
s3_bucket_cross_region_replication
Amazon S3 buckets use cross-Region replication with versioning and an enabled rule that targets a destination bucket in a different AWS Region.
Buckets with same-Region targets, missing destinations, or disabled versioning don't meet this replication posture.
Risk
Single-Region storage creates an availability gap: a Regional outage, control-plane isolation, or denial of service can make data unreachable.
Lack of replication raises RPO/RTO, delaying recovery and disrupting multi-Region workloads. Missing replicas also weaken data integrity during restore from corruption or deletion.
prowler aws --checks s3_bucket_cross_region_replication
Recommendation
Enable CRR to a different Region with versioning and least-privilege roles.
- Replicate needed prefixes and metadata
- Consider
S3 Replication Time Controlfor tighter RPO - Protect deletes via
delete markerstrategy and Object Lock - Monitor replication metrics and test DR regularly
Align with defense in depth and availability by design.
Remediation
- In the S3 console, open the source bucket
- Go to Properties > Bucket Versioning and click Enable
- Go to Management > Replication rules > Create replication rule
- Scope: Apply to all objects in the bucket
- Destination: Select a bucket in a different AWS Region
- Status: Ensure Enabled is selected
- IAM role: Choose Create new role (recommended)
- Save the rule
Source Code
Resource Type
AwsS3Bucket