--- title: "S3 Synchronous Replication with Active-Directory Users and Bucket Policy" slug: "s3-synchronous-replication-with-active-directory-users-and-bucket-policy" description: "Configure synchronous S3 replication with Active Directory users and bucket policies on VAST Cluster 5.2. Follow our step-by-step guide for seamless setup." updated: 2026-10-28T18:40:50Z published: 2026-10-28T18:40:50Z canonical: "docs.vastdata.com/s3-synchronous-replication-with-active-directory-users-and-bucket-policy" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.vastdata.com/llms.txt > Use this file to discover all available pages before exploring further. # S3 Synchronous Replication with Active-Directory Users and Bucket Policy > [!NOTE] > ℹ️ Info > > This document is intended to provide clear instructions for configuring synchronous S3 replication using Active-Directory users and Bucket policies. The steps listed in this procedure have been tested on VAST Cluster 5.2 ## Create a Bucket Policy **Important notes:** - Policy create/attach/delete can be performed only using 3rd third-party tool such as `aws-cli`. - Only the **bucket owner** can attach or modify bucket policies. - Supported starting from VAST Cluster version 5.2. Bucket policy can only be managed from cli therefore first login to a machine with access to the S3 endpoint and create a JSON file with the desired policy, in the below example you can find a policy template that will allow all action on a specific bucket and its subdirectories, you can review the bucket policy wiki or aws documentation for more details on policies permutations and tuning. **Policy JSON** (`allow-all-s3.json`): ```plaintext {  "Version": "2012-10-17",  "Statement": [    {      "Sid": "allow-all-s3",      "Effect": "Allow",      "Principal": "*",      "Action": "s3:*",      "Resource": [        "arn:aws:s3:::managed-by-b-policy",        "arn:aws:s3:::managed-by-b-policy/*"      ]    }  ] } ``` ## Attach Policy to Bucket - Use the command below to attach the JSON file (allow-all-s3.json) policy to the `managed-by-b-policy` bucket. ```plaintext aws s3api put-bucket-policy \  --bucket managed-by-b-policy \  --policy file://allow-all-s3.json \  --endpoint-url http://172.27.115.1 ``` - You can (and should) validate the attachment by running the command below. ```plaintext aws s3api get-bucket-policy \  --bucket managed-by-b-policy \  --endpoint-url http://172.27.115.1 ``` ## Enable S3 Bucket replication **This action needs to be done on both clusters** - From the VAST UI, go to **Settings.** - Click on **S3** and **Enable the Bucket Replication.** ![Enable the Bucket Replication](https://cdn.us.document360.io/89b91113-5dc6-49db-86ec-57b16dc8ce56/Images/Documentation/ec15cc8d-acfb-4af7-be85-85742783d231.png?sv=2026-02-06&spr=https&st=2026-11-08T09%3A27%3A16Z&se=2026-11-08T10%3A27%3A16Z&sr=c&sp=r&sig=N6eZcBPHdq%2B%2FpftKmXGBGv2bDlPVwqHMWIuQEk2TfKs%3D) Enable the Bucket Replication > [!NOTE] > ℹ️ Info > > You will be prompted to enable the replication. Note that this option is not reversible. ![Confirm Enable the Bucket Replication](https://cdn.us.document360.io/89b91113-5dc6-49db-86ec-57b16dc8ce56/Images/Documentation/c95054bd-f17f-4a83-a6c8-752e27b8384b.png?sv=2026-02-06&spr=https&st=2026-11-08T09%3A27%3A16Z&se=2026-11-08T10%3A27%3A16Z&sr=c&sp=r&sig=N6eZcBPHdq%2B%2FpftKmXGBGv2bDlPVwqHMWIuQEk2TfKs%3D) Confirm Enable the Bucket Replication ## Configure Active-Directory - Log in to VAST UI. - Go to **User Management.** - Go to the **Active Directory** tab. - Click on the **Create Active Directory** button. - Fill all required fields with your Active Directory details. ![Create Active Directory](https://cdn.us.document360.io/89b91113-5dc6-49db-86ec-57b16dc8ce56/Images/Documentation/d82347bf-a0c2-4884-af84-850f79945cbf.png?sv=2026-02-06&spr=https&st=2026-11-08T09%3A27%3A16Z&se=2026-11-08T10%3A27%3A16Z&sr=c&sp=r&sig=N6eZcBPHdq%2B%2FpftKmXGBGv2bDlPVwqHMWIuQEk2TfKs%3D) Create Active Directory - Click on **Create.** - Wait for the newly created Active Directory status to change to **Connected.** - Right-click on the Active Directory and choose **Join.** - Fill in the user and password and click **Join.** ![Join Active Directory](https://cdn.us.document360.io/89b91113-5dc6-49db-86ec-57b16dc8ce56/Images/Documentation/335c9d5e-6deb-4863-b626-993dfb9ebecd.png?sv=2026-02-06&spr=https&st=2026-11-08T09%3A27%3A16Z&se=2026-11-08T10%3A27%3A16Z&sr=c&sp=r&sig=N6eZcBPHdq%2B%2FpftKmXGBGv2bDlPVwqHMWIuQEk2TfKs%3D) Join Active Directory ## Configure Active-Directory user on VAST Cluster - Go to the **Users** tab. - Click on the query button in the upper right corner of the screen. ![Query user](https://cdn.us.document360.io/89b91113-5dc6-49db-86ec-57b16dc8ce56/Images/Documentation/ddf5dd48-4fe7-4cb5-aac8-ac90b9d6e9c8.png?sv=2026-02-06&spr=https&st=2026-11-08T09%3A27%3A16Z&se=2026-11-08T10%3A27%3A16Z&sr=c&sp=r&sig=N6eZcBPHdq%2B%2FpftKmXGBGv2bDlPVwqHMWIuQEk2TfKs%3D) Query user - Enter a username and click the **Query** button. ![Enter user details for query](https://cdn.us.document360.io/89b91113-5dc6-49db-86ec-57b16dc8ce56/Images/Documentation/53798a98-31cc-4c85-9e87-03a85b8b4e76.png?sv=2026-02-06&spr=https&st=2026-11-08T09%3A27%3A16Z&se=2026-11-08T10%3A27%3A16Z&sr=c&sp=r&sig=N6eZcBPHdq%2B%2FpftKmXGBGv2bDlPVwqHMWIuQEk2TfKs%3D) Enter user details for query - The windows will be closed, and the user's view will change to display the selected Active Directory user. ## Set keys for Active Directory User - Right-click on the user and click **Edit.** - Choose the **Identity Policy** to use. - Choose Bucket permissions (Allow create, Allow Delete). - Click on the **Create keys.** > [!NOTE] > ℹ️ Info > > Save the newly generated access and secret keys in a secure location (e.g., a password manager or secrets vault). ![User details](https://cdn.us.document360.io/89b91113-5dc6-49db-86ec-57b16dc8ce56/Images/Documentation/a0417b3c-4232-4276-a32a-8a2893da3317.png?sv=2026-02-06&spr=https&st=2026-11-08T09%3A27%3A16Z&se=2026-11-08T10%3A27%3A16Z&sr=c&sp=r&sig=N6eZcBPHdq%2B%2FpftKmXGBGv2bDlPVwqHMWIuQEk2TfKs%3D) User details - That will look like the following. ![Example of user details](https://cdn.us.document360.io/89b91113-5dc6-49db-86ec-57b16dc8ce56/Images/Documentation/2ce3db80-97f3-49a5-8e50-4a84b6c28412.png?sv=2026-02-06&spr=https&st=2026-11-08T09%3A27%3A16Z&se=2026-11-08T10%3A27%3A16Z&sr=c&sp=r&sig=N6eZcBPHdq%2B%2FpftKmXGBGv2bDlPVwqHMWIuQEk2TfKs%3D) Example of user details - Click **Update** to complete the operation. > [!NOTE] > ℹ️ Info > > NOTE: The keys will be migrated to the remote (**DR**) cluster; no additional actions are required. ## Set the Active-Directory User as the Bucket Owner - In the VAST UI, navigate to the **Element Store** and to the **View menu.** ![Navigate to the Element Store and to the View menu](https://cdn.us.document360.io/89b91113-5dc6-49db-86ec-57b16dc8ce56/Images/Documentation/b415934e-058b-4c88-815d-b7d4d8b6cf1a.png?sv=2026-02-06&spr=https&st=2026-11-08T09%3A27%3A16Z&se=2026-11-08T10%3A27%3A16Z&sr=c&sp=r&sig=N6eZcBPHdq%2B%2FpftKmXGBGv2bDlPVwqHMWIuQEk2TfKs%3D) Navigate to the Element Store and to the View menu - Right-click on the **View** you want to edit. - In the S3 section, add/set the Active Directory user. ![Update View](https://cdn.us.document360.io/89b91113-5dc6-49db-86ec-57b16dc8ce56/Images/Documentation/698dae62-dc77-420d-9939-e0a2319d8d30.png?sv=2026-02-06&spr=https&st=2026-11-08T09%3A27%3A16Z&se=2026-11-08T10%3A27%3A16Z&sr=c&sp=r&sig=N6eZcBPHdq%2B%2FpftKmXGBGv2bDlPVwqHMWIuQEk2TfKs%3D) Update View - Click “**Update**” to complete the operation. - Configure Protected Path. ## Configure Protected Path - From the VAST UI, navigate to **Data Protection.** - Click on **Protected Path.** - Click on **Create Protected Path** and choose **New Remote Protected Path.** ![New Remote Protected Path](https://cdn.us.document360.io/89b91113-5dc6-49db-86ec-57b16dc8ce56/Images/Documentation/8d03c026-63f2-4e73-9eb9-20d22c82637e.png?sv=2026-02-06&spr=https&st=2026-11-08T09%3A27%3A16Z&se=2026-11-08T10%3A27%3A16Z&sr=c&sp=r&sig=N6eZcBPHdq%2B%2FpftKmXGBGv2bDlPVwqHMWIuQEk2TfKs%3D) New Remote Protected Path - **Name** the new protected path and fill the **Path** field. - Note that you can set the path to a specific bucket or to an endpoint. In this example, we’ve pointed to an endpoint, so every bucket that will be created under this endpoint will be included within the replication. ![Create a new protected path](https://cdn.us.document360.io/89b91113-5dc6-49db-86ec-57b16dc8ce56/Images/Documentation/ce3a1673-e2bc-40a2-ad61-0ebfd3112f53.png?sv=2026-02-06&spr=https&st=2026-11-08T09%3A27%3A16Z&se=2026-11-08T10%3A27%3A16Z&sr=c&sp=r&sig=N6eZcBPHdq%2B%2FpftKmXGBGv2bDlPVwqHMWIuQEk2TfKs%3D) Create a new protected path - Click **Next.** - Fill in the needed details for the remote site, as in the example below. ![Fill in details for new Remote Protected Path](https://cdn.us.document360.io/89b91113-5dc6-49db-86ec-57b16dc8ce56/Images/Documentation/f05e8597-af2e-46ae-a39f-6f305449fb83.png?sv=2026-02-06&spr=https&st=2026-11-08T09%3A27%3A16Z&se=2026-11-08T10%3A27%3A16Z&sr=c&sp=r&sig=N6eZcBPHdq%2B%2FpftKmXGBGv2bDlPVwqHMWIuQEk2TfKs%3D) Fill in details for new Remote Protected Path - Click **Add.** - Set the connectivity timeout. ![Add a connectivity timeout](https://cdn.us.document360.io/89b91113-5dc6-49db-86ec-57b16dc8ce56/Images/Documentation/3d2e4ff5-e334-4291-8c10-be9e0bd5bf0a.png?sv=2026-02-06&spr=https&st=2026-11-08T09%3A27%3A16Z&se=2026-11-08T10%3A27%3A16Z&sr=c&sp=r&sig=N6eZcBPHdq%2B%2FpftKmXGBGv2bDlPVwqHMWIuQEk2TfKs%3D) Add a connectivity timeout - Click **Add.** - Click **Create** to complete the operation. ![Complete setup](https://cdn.us.document360.io/89b91113-5dc6-49db-86ec-57b16dc8ce56/Images/Documentation/5ef0743a-9b60-4579-a587-8bf66de6b215.png?sv=2026-02-06&spr=https&st=2026-11-08T09%3A27%3A16Z&se=2026-11-08T10%3A27%3A16Z&sr=c&sp=r&sig=N6eZcBPHdq%2B%2FpftKmXGBGv2bDlPVwqHMWIuQEk2TfKs%3D) Complete setup - Wait until the replication state becomes **Active.** > [!NOTE] > ℹ️ Info > > At the point the replication is configured and the bucket can be accessed on each cluster with the same keys.