title: I am getting "ACCESS_DENIED" error when I tried to create the "put_bucket_replication" using boto3
body: <p><strong>I am trying to run the py script which has replication_configuration, while executing I am getting "ACCESS_DENIED" error.</strong> </p>
  
  <p><strong>Rrplication_configuration.py</strong></p>
  
  <pre><code>import boto3
  
  client = boto3.client('s3')
  
  response = client.put_bucket_replication(
      Bucket='s3remotestaebackendbucket',
      ReplicationConfiguration={
          'Role': 'arn:aws:iam:::role/tf-iam-role-replication',
          'Rules': [
              {
                  "ID": "abcd",
                  'Prefix': '',
                  'Status': 'Enabled',
                  'Destination': {
                      'Bucket': 'arn:aws:s3:::s3remotestaebackendreplicationbucket',
                      'StorageClass': 'STANDARD'
                  }
              },
          ]
      }
  )
  </code></pre>
  
  <p><strong>Error</strong></p>
  
  <p>botocore.exceptions.ClientError: An error occurred (AccessDenied) when calling the PutBucketReplication operation: Access Denied**</p>
  
  <p><strong>S3 ROLE</strong></p>
  
  <pre><code>{
    "Version": "2012-10-17",
    "Statement": [
      {
        "Action": "sts:AssumeRole",
        "Principal": {
          "Service": "s3.amazonaws.com"
        },
        "Effect": "Allow",
        "Sid": ""
      }
    ]
  }
  </code></pre>
  
  <p><strong>POLICY</strong></p>
  
  <pre><code>{
    "Version": "2012-10-17",
    "Statement": [
      {
        "Action": [
          "s3:GetReplicationConfiguration",
          "s3:ListBucket"
        ],
        "Effect": "Allow",
        "Resource": [
          "${var.source_bucket_arn}"
        ]
      },
      {
        "Action": [
          "s3:GetObjectVersion",
          "s3:GetObjectVersionAcl"
        ],
        "Effect": "Allow",
        "Resource": [
          "${var.source_bucket_arn}/*"
        ]
      },
      {
        "Action": [
          "s3:ReplicateObject",
          "s3:ReplicateDelete"
        ],
        "Effect": "Allow",
        "Resource": "${var.destination_bucket_arn}/*"
      }
    ]
  }
  </code></pre>
  
  <p><strong>IAM_USER_PASSROLE</strong></p>
  
  <pre><code>{
      "Version": "2012-10-17",
      "Statement": [
          {
              "Effect": "Allow",
              "Action": [
                  "iam:GetRole",
                  "iam:PassRole"
              ],
              "Resource": "arn:aws:iam:::role/tf-iam-role-replication"
          }
      ]
  }
  </code></pre>
  
  <p>Can any one help me to fix this error. Where I had done the mistake?
  This sample code will include the terrraform variable declarations</p>