Architecture
Overview
Section titled “Overview”One account holds two buckets. Consumers do not call S3 across Regions: each
uses a gateway VPC endpoint
S3 gateway VPC endpoint. Route-table target that keeps S3 traffic on the AWS network; no hourly charge for the gateway itself.
in its own
Region and the local bucket hostname.
Replication
Cross-Region Replication. S3 copies objects (and versions) from a primary bucket to a replica in another Region.
copies objects from Sydney to
Auckland after you publish.
Same key, regional URL:
https://<primary>.s3.ap-southeast-2.amazonaws.com/demo/...https://<replica>.s3.ap-southeast-6.amazonaws.com/demo/...Who owns what
Section titled “Who owns what”| Piece | Account | Region |
|---|---|---|
| Primary bucket (source) | Shared | ap-southeast-2 |
| Replica bucket | Shared | ap-southeast-6 |
| Syd gateway + probe EC2 | Same account in this lab | ap-southeast-2 |
| Akl gateway + probe EC2 | Same account in this lab | ap-southeast-6 |
Bucket policies deny access unless aws:SourceVpce matches an allowlisted
endpoint. Publish, admin, and replication principals get a bypass.
Out of scope
Section titled “Out of scope”- CloudFront / public CDN
- One global hostname (MRAP)
- S3 interface endpoints for cross-Region reads
- Package-manager
repodata(plain objects only)