---
title: "Configuring S3 Synchronous Replication"
slug: "s3-synchronous-replication"
tags: ["5.5"]
updated: 2026-11-03T11:02:12Z
published: 2026-11-03T11:02:12Z
canonical: "docs.vastdata.com/s3-synchronous-replication"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.vastdata.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Configuring S3 Synchronous Replication

> [!NOTE]
> Note
> 
> Synchronous replication is subject to the following restriction on protected paths between tenants on different clusters:
> 
> - If Tenant A replicates a protected path to Tenant B on a remote cluster, it cannot then replicate another path to Tenant C on the same remote cluster (that is, Tenant A cannot have replicated protected paths to more than one tenant on the same remote cluster). It can, however, replicate protected paths to Tenant C (or any other tenant) on a different remote cluster. Similarly, Tenant A can replicate additional protected paths to Tenant B on the same remote cluster.

Follow these steps on the primary cluster. This configures synchronous replication to a single secondary cluster.

1. Make sure there is a virtual IP pool on each of the peer clusters that is dedicated to replication, that you want to use for this replication. The role of the virtual IP pool must be set to *replication*. A replication VIP pool is used exclusively for routing replication traffic between the peers and not for serving data to clients. The CNodes that are assigned virtual IPs from the replication virtual IP pool are used to communicate directly with the remote peer, while other CNodes can communicate only indirectly with the remote peer.

If there is no such virtual IP pool on any of the clusters, follow the procedure to [create a virtual IP pool](/docs-5-5/docs/managing-virtual-ip-pools#creating-virtual-ip-pools), and be sure to set the role to *Replication*.
2. If you want to configure replication in secure mode, with mTLS encryption, make sure that [mTLS certificates](/docs-5-5/docs/encrypting-replication-with-mtls) are installed on every participating cluster.
3. [Create a replication peer](/docs-5-5/docs/managing-replication-peers#creating-a-replication-peer-in-vast-web-ui). This is the configuration of a replication relationship with another cluster. The peer configuration is mirrored on the destination peer.
4. [Create a remote protected path](/docs-5-5/docs/managing-protected-paths#creating-a-remote-protected-path) with a single destination and *Sync Replication* as the mode. This defines a data path on the cluster to replicate. The path you specify to replicate must be an existing S3 bucket. It also defines the destination path on the peer.

> [!NOTE]
> Note
> 
> There is no need to create a protection policy for synchronous replication.