title: S3 replication: Access denied: Amazon S3 can't detect whether versioning is enabled on the destination bucket
body: <p>I'm configuring a replication between two s3 buckets. but I get the error</p>
  
  <blockquote>
    <p>Access denied: Amazon S3 can't detect whether versioning is enabled on
    the destination bucket.</p>
  </blockquote>
  
  <p>The destination bucket is in another account, different region.
  Here is the bucket policy in the destination bucket:</p>
  
  <pre><code>{
      "Version": "2012-10-17",
      "Statement": [
          {
              "Effect": "Deny",
              "Principal": "*",
              "Action": "s3:*",
              "Resource": [
                  "arn:aws:s3:::destination",
                  "arn:aws:s3:::destination/*"
              ],
              "Condition": {
                  "StringNotLike": {
                      "aws:userId": [
                          "AROAS3AHCETXXDF5Z5GVG:*",
                          "AROAS3AHCETXX2DMH4JPY:*",
                          "AROAS3AHCEXXX4SNCNTNV:*",
                          "AROAVJZZXXXXXZBBR7PN6L:*"
                      ]
                  }
              }
          },
          {
              "Sid": "S3ReplicationPolicyStmt1",
              "Effect": "Allow",
              "Principal": {
                  "AWS": "arn:aws:iam::XXXXXXXXXXX:root"
              },
              "Action": [
                  "s3:GetBucketVersioning",
                  "s3:GetObjectVersionForReplication",
                  "s3:PutBucketVersioning",
                  "s3:ReplicateObject",
                  "s3:ReplicateDelete",
                  "s3:PutObjectAcl",
                  "s3:ObjectOwnerOverrideToBucketOwner"
              ],
              "Resource": [
                  "arn:aws:s3:::destination",
                  "arn:aws:s3:::destination/*"
              ]
          }
      ]
  }
  </code></pre>
  
  <p>My buckets are highly confidential, so I first deny all access except for some roles: So in the condition, I have the replication role ID excluded too.</p>
  
  <p>Why the replication role is still not allowed to replicate? What is wrong with this bucket policy ?
  In the above policy I actually authorize the replication role twice. in both statements.</p>
  
  <p>Here is the replication IAM role policy:</p>
  
  <pre><code>{
      "Version": "2012-10-17",
      "Statement": [
          {
              "Action": [
                  "s3:Get*",
                  "s3:ListBucket"
              ],
              "Effect": "Allow",
              "Resource": [
                  "arn:aws:s3:::source",
                  "arn:aws:s3:::source/*"
              ]
          },
          {
              "Action": [
                  "s3:ReplicateObject",
                  "s3:ReplicateDelete",
                  "s3:ReplicateTags",
                  "s3:GetBucketVersioning",
                  "s3:GetObjectVersionTagging",
                  "s3:ObjectOwnerOverrideToBucketOwner"
              ],
              "Effect": "Allow",
              "Resource": "arn:aws:s3:::destination/*"
          }
      ]
  }
  </code></pre>
  
  <p>I tried deleting the explicite deny statement and test the replication, the source bucket gets the Versioning and <strong>I had no access denied, but objects are not replicated.</strong></p>