Shared buckets

Progress checklist

Primary bucket in Sydney
Replica bucket in Auckland
Versioning and SSE-S3 on both
Replication role + rule for demo/

Overview

demo.sh up-shared creates the two buckets, turns on versioning and SSE-S3, wires Syd to Akl replication for demo/, and writes IDs to .lab-state.json (gitignored).

Steps

Create primary + replica:

export AWS_PROFILE=sandbox
aws sts get-caller-identity
./scripts/demo.sh up-shared

On success the script ends with:

up-shared complete: ps3a-artifacts-**ACCOUNT**-syd → ps3a-artifacts-**ACCOUNT**-akl

Check state:

./scripts/demo.sh status

Example (account id redacted):

{
  "suffix": "20260904200753",
  "name_prefix": "ps3a",
  "primary_region": "ap-southeast-2",
  "replica_region": "ap-southeast-6",
  "demo_prefix": "demo/",
  "consumers": {},
  "primary_bucket": "ps3a-artifacts-**ACCOUNT**-syd",
  "replica_bucket": "ps3a-artifacts-**ACCOUNT**-akl",
  "crr_role_arn": "arn:aws:iam::**ACCOUNT**:role/ps3a-crr-20260904200753",
  "bypass_principal_arn": "arn:aws:iam::**ACCOUNT**:role/aws-reserved/sso.amazonaws.com/ap-southeast-2/AWSReservedSSO_…"
}

Verify

aws s3api head-bucket --bucket "$(jq -r .primary_bucket .lab-state.json)" --region ap-southeast-2
aws s3api head-bucket --bucket "$(jq -r .replica_bucket .lab-state.json)" --region ap-southeast-6
aws s3api get-bucket-versioning --bucket "$(jq -r .primary_bucket .lab-state.json)" --region ap-southeast-2
aws s3api get-bucket-replication --bucket "$(jq -r .primary_bucket .lab-state.json)" --region ap-southeast-2

Expected shape (redacted):

# head-bucket (each Region)
BucketRegion: ap-southeast-2 | ap-southeast-6

# versioning
{ "Status": "Enabled" }

# replication
Rule ID demo-to-akl, Prefix demo/, Destination …-akl, Status Enabled

Both buckets also get SSE-S3 (AES256), public access block, and a bootstrap bucket policy that allows your SSO role plus the CRR role (VPCE lock comes in allowlist).

Consumer

Shared buckets

Overview

Steps

Verify

Next