The following features enable S3 access to data at replicated protected paths:
Replication of S3 Access Key Pairs and Identity Policies
S3 access key pairs and identity policies are replicated between replication peers along with protected path data as follows:
Access key pairs and identity policies associated with any users on external authorization providers that are configured on the source and the destination peer clusters are replicated from source peer to destination peer and vice versa. Access keys and identity policies are not replicated for users on the cluster's VAST provider.
Each cluster stores access key pairs and identity policies as either local or remote. Access keys and identity policies that are received by replication from remote peers are stored as remote. They cannot be modified or deleted, although they can be enabled and disabled. Remote identity policies are disabled by default.
No configuration is required to enable this feature.
Bucket Replication
Bucket replication recreates a bucket for you on each destination peer of a protected path, with the properties of the source bucket on the replication source peer. It prevents the need to manually create buckets in order to enable S3 access to data at replicated paths.
If bucket replication is enabled on a protected path, any S3 buckets on or under replicated protected paths are automatically recreated at the replication destination path, provided that:
The bucket view on the source peer is configured with the S3 default view policy.
There is an S3 default view policy on the destination tenant.
Buckets that are created by the bucket replication feature are created as bucket-enabled views with the S3 default view policy that is configured on the destination tenant where the path is replicated.
If a bucket was created manually on the destination with the same name as the equivalent bucket at the source path, the source bucket's properties are applied to the manually created bucket.
The following properties of the source bucket are applied to the destination bucket:
Object versioning status
s3 lock enablement status
object ownership rule
allow anonymous access status
has db status
The bucket policy
Enabling and Disabling Bucket Replication
When you create a new protected path, you can choose to enable or disable bucket replication. After creating a protected path, you cannot enable or disable bucket replication on the protected path.
The default setting for new protected paths depends on the cluster's upgrade and version history. On clusters newly installed with VAST Cluster 5.5, bucket replication is disabled by default. If your cluster was upgraded from VAST Cluster 5.4, the default depends on the legacy bucket replication setting, which affected all protected paths on the cluster. That is, if bucket replication was enabled prior to upgrade, then it is enabled by default on new protected paths. Otherwise, it is disabled by default.
Likewise, any protected paths that existed on the cluster prior to upgrade have bucket replication enabled or disabled in accordance with the legacy setting.
To control the bucket replication setting when you create a protected path:
When you create the protected path using the VAST Web UI, select the Enable bucket replication option to enable bucket replication. If you do not want bucket replication to be enabled on the protected path, deselect the checkbox.
When you create the protected path using the protectedpath create VAST CLI command, use
--enable-bucket-replicationto make sure bucket replication is enabled, or--disable-bucket-replicationto make sure bucket replication is disabled.