title: S3 Cross region replication using Terraform
body: <p>I was using Terraform to setup S3 buckets (different region) and set up replication between them.</p>
  
  <p>It was working properly until I added KMS in it.</p>
  
  <p>I created 2 KMS keys one for source and one for destination.</p>
  
  <p>Now while applying <strong>replication configuration</strong>, there is an option to pass destination key for destination bucket but I am not sure how to apply key at the source.</p>
  
  <p>Any help would be appreciated.</p>
  
  <p><div class="snippet" data-lang="js" data-hide="false" data-console="true" data-babel="false">
  <div class="snippet-code">
  <pre class="snippet-code-html lang-html prettyprint-override"><code>provider "aws" {
    alias  = "east"
    region = "us-east-1"
  }
  
  resource "aws_s3_bucket" "destination-bucket" {
    bucket = ""destination-bucket"
    provider = "aws.east"
    acl    = "private"
    region   = "us-east-1"
    versioning {
      enabled = true
    }
    server_side_encryption_configuration {
      rule {
        apply_server_side_encryption_by_default {
          kms_master_key_id = "${var.kms_cmk_dest_arn}"
          sse_algorithm     = "aws:kms"
        }
      }
    }
  }
  
  resource "aws_s3_bucket" "source-bucket" {
    bucket = "source-bucket"
    acl    = "private"
    versioning {
      enabled = true
    }
    server_side_encryption_configuration {
      rule {
        apply_server_side_encryption_by_default {
          kms_master_key_id = "${var.kms_cmk_arn}"
          sse_algorithm     = "aws:kms"
        }
      }
    }
    replication_configuration {
      role = "${aws_iam_role.replication.arn}"
  
      rules {
        status = "Enabled"
     destination {
          bucket        = "${aws_s3_bucket.source-bucket.arn}"
          storage_class = "STANDARD"
    replica_kms_key_id = "${var.kms_cmk_dest_arn}"
        }
     source_selection_criteria {
        sse_kms_encrypted_objects {
        enabled = true
     }
      }
      }
    }
  }
  
  resource "aws_iam_role" "replication" {
    name = "cdd-iam-role-replication"
    permissions_boundary    = "arn:aws:iam::${var.account_id}:policy/ServiceRoleBoundary"
    assume_role_policy = &lt;&lt;POLICY
  {
    "Version": "2012-10-17",
    "Statement": [
      {
        "Action": "sts:AssumeRole",
        "Principal": {
          "Service": "s3.amazonaws.com"
        },
        "Effect": "Allow",
        "Sid": ""
      }
    ]
  }
  POLICY
  }
  
  resource "aws_iam_role_policy" "replication" {
    name = "cdd-iam-role-policy-replication"
    role = "${aws_iam_role.replication.id}"
  
    policy = &lt;&lt;POLICY
  {
    "Version": "2012-10-17",
    "Statement": [
      {
        "Action": [
          "s3:GetReplicationConfiguration",
          "s3:ListBucket"
        ],
        "Effect": "Allow",
        "Resource": [
          "${aws_s3_bucket.source-bucket.arn}"
        ]
      },
      {
        "Action": [
          "s3:GetObjectVersion",
          "s3:GetObjectVersionAcl"
        ],
        "Effect": "Allow",
        "Resource": [
          "${aws_s3_bucket.source-bucket.arn}/*"
        ]
      },
      {
        "Action": [
          "s3:ReplicateObject",
          "s3:ReplicateDelete"
        ],
        "Effect": "Allow",
        "Resource": "${aws_s3_bucket.destination-bucket.arn}/*"
      }
    ]
  }
  POLICY
  }</code></pre>
  </div>
  </div>
  </p>