--- title: "S3 Asynchronous Replication with Active-Directory Users and Identity Policy" slug: "s3-asynchronous-replication-with-active-directory-users-and-identity-policy" description: "Configure Asynchronous S3 replication with Active Directory and identity policies on VAST 5.2+. Follow our step-by-step guide for seamless setup." updated: 2026-10-28T18:40:50Z published: 2026-10-28T18:40:50Z canonical: "docs.vastdata.com/s3-asynchronous-replication-with-active-directory-users-and-identity-policy" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.vastdata.com/llms.txt > Use this file to discover all available pages before exploring further. # S3 Asynchronous Replication with Active-Directory Users and Identity Policy > [!NOTE] > ℹ️ Info > > This document is intended to provide clear instructions for configuring Asynchronous S3 replication using Active Directory and identity policies. The steps listed in this procedure have been tested on VAST 5.2 and above. ## Create an Identity Policy - Log in to the VAST UI. - Go to **User Management.** - Click on **Identity Policy.** - Click on **Create Policy,** type a name for the new policy, and set the policy definition. The policy definition can be done using the **Action** and **Resource** drop-down menu or by using the JSON code box. You can use the example below of JSON code to set the policy. ![The image displays an interface for creating and configure AWS S3 policy settings, where users can define permissions interactively by selecting actions and resources to allow or deny access.](https://cdn.us.document360.io/89b91113-5dc6-49db-86ec-57b16dc8ce56/Images/Documentation/4c07df54-d0b5-43c1-866d-c6422ca7ad66.png?sv=2026-02-06&spr=https&st=2026-11-08T09%3A30%3A35Z&se=2026-11-08T10%3A30%3A35Z&sr=c&sp=r&sig=b0EM4Lxkkp7ZTlrP%2FDi5TjCUH8mpbfmaChCGYMrVXIo%3D) Sample JSON code policy JSON policy definition example. ```plaintext {  "Version": "2012-10-17",  "Statement": [    {      "Effect": "Allow",      "Action": [        "s3:*"      ],      "Resource": "*"    }  ] } ``` > [!NOTE] > ℹ️ Info > > NOTE - The identity policy is automatically replicated to the DR(remote) cluster, but in **Disabled** mode, please manually enable it. ## Configure Active Directory - Log in to VAST UI. - Go to **User Management.** - Go to the **Active Directory** tab. - Click on the **Create Active Directory** button. - Fill all required fields with your Active Directory details. ![The image showcases the configuration interface for setting up Active Directory on an application, including fields such as domain name, machine account name, organizational unit, port number, and bind DN. The attribute mapping section allows users to customize how attributes map between the directory and the system.](https://cdn.us.document360.io/89b91113-5dc6-49db-86ec-57b16dc8ce56/Images/Documentation/ef7cb480-527b-47aa-babb-7446c044a5db.png?sv=2026-02-06&spr=https&st=2026-11-08T09%3A30%3A35Z&se=2026-11-08T10%3A30%3A35Z&sr=c&sp=r&sig=b0EM4Lxkkp7ZTlrP%2FDi5TjCUH8mpbfmaChCGYMrVXIo%3D) Active Directory details - Click on **Create.** - Wait for the newly created Active Directory status to change to **Connected.** - Right-click on the Active Directory and choose **Join.** - Fill in the user and password and click **Join.** ![The image displays an interface for joining Active Directory with the domain "vasteng.lab," where users need to input their admin username and password to complete the join process.](https://cdn.us.document360.io/89b91113-5dc6-49db-86ec-57b16dc8ce56/Images/Documentation/7e1795ef-5257-48f5-8945-03e001f301d9.png?sv=2026-02-06&spr=https&st=2026-11-08T09%3A30%3A35Z&se=2026-11-08T10%3A30%3A35Z&sr=c&sp=r&sig=b0EM4Lxkkp7ZTlrP%2FDi5TjCUH8mpbfmaChCGYMrVXIo%3D) Join Active Directory ## Configure Active Directory user on VAST Cluster - Go to the **Users** tab. - Click on the query button in the upper right corner of the screen. ![The user management screen displays local users with columns including Name, Login Name, UID, SID, and permissions such as creating buckets and deleting buckets, indicated by green checkmarks throughout their entries. A](https://cdn.us.document360.io/89b91113-5dc6-49db-86ec-57b16dc8ce56/Images/Documentation/f241a356-f1ff-4205-b206-7cff1c37000e.png?sv=2026-02-06&spr=https&st=2026-11-08T09%3A30%3A35Z&se=2026-11-08T10%3A30%3A35Z&sr=c&sp=r&sig=b0EM4Lxkkp7ZTlrP%2FDi5TjCUH8mpbfmaChCGYMrVXIo%3D) Slect query button - Enter a username and click the **Query** button. ![The image shows a query user interface where users can input details such as a username, login name, and context to perform a tenant-specific search operation. The interface also includes options like 'UID', 'SID', 'Context' (set to 'Aggregated'), and 'Tenant' (defaulted to 'default').](https://cdn.us.document360.io/89b91113-5dc6-49db-86ec-57b16dc8ce56/Images/Documentation/a83502ad-fe04-415b-892c-59213e80329b.png?sv=2026-02-06&spr=https&st=2026-11-08T09%3A30%3A35Z&se=2026-11-08T10%3A30%3A35Z&sr=c&sp=r&sig=b0EM4Lxkkp7ZTlrP%2FDi5TjCUH8mpbfmaChCGYMrVXIo%3D) Query user - The windows will be closed, and the user's view will change to display the selected Active Directory user. ## Enable S3 Bucket Replication. **Production Cluster** - From the VAST UI, go to **Settings.** - Click on **S3** and **Enable the Bucket Replication.** ![The screenshot displays the S3 configuration settings in a cloud management interface, where options such as enabling HTTP and HTTPS protocols, CORS (Cross-Origin Resource Sharing), and bucket replication can be turned on or off according to security requirements. Additionally, it highlights that S3 Signature V2 is less secure than V4 and should only be used if necessary.](https://cdn.us.document360.io/89b91113-5dc6-49db-86ec-57b16dc8ce56/Images/Documentation/7335b0a2-947e-4cbd-b571-58d232d070ee.png?sv=2026-02-06&spr=https&st=2026-11-08T09%3A30%3A35Z&se=2026-11-08T10%3A30%3A35Z&sr=c&sp=r&sig=b0EM4Lxkkp7ZTlrP%2FDi5TjCUH8mpbfmaChCGYMrVXIo%3D) Enable the Bucket Replication > [!NOTE] > ℹ️ Info > > You will be prompted to enable the replication. Note that this option is not reversible. ![ab1aeb68-97d4-4e12-a23c-e2f7548747fb.png](https://cdn.us.document360.io/89b91113-5dc6-49db-86ec-57b16dc8ce56/Images/Documentation/ab1aeb68-97d4-4e12-a23c-e2f7548747fb.png?sv=2026-02-06&spr=https&st=2026-11-08T09%3A30%3A35Z&se=2026-11-08T10%3A30%3A35Z&sr=c&sp=r&sig=b0EM4Lxkkp7ZTlrP%2FDi5TjCUH8mpbfmaChCGYMrVXIo%3D) Confirm enable bucket replication ## Create a Replication Peer - From the VAST UI, go to **Data Protection.** - **Replication Peers**, then click the **Create Peer** button. - Name the new peer and provide the **Remote VIP** address, choose the **Local IP Pool** to use, and click on **Create.** ![00f07bfc-3d7d-4a23-ac8f-0c7d2ba02659.png](https://cdn.us.document360.io/89b91113-5dc6-49db-86ec-57b16dc8ce56/Images/Documentation/00f07bfc-3d7d-4a23-ac8f-0c7d2ba02659.png?sv=2026-02-06&spr=https&st=2026-11-08T09%3A30%3A35Z&se=2026-11-08T10%3A30%3A35Z&sr=c&sp=r&sig=b0EM4Lxkkp7ZTlrP%2FDi5TjCUH8mpbfmaChCGYMrVXIo%3D) Add a native replication peer - Wait a few moments and verify that the peer is connected before moving on. ![166e2163-218e-4eec-9ccb-10147212a272.png](https://cdn.us.document360.io/89b91113-5dc6-49db-86ec-57b16dc8ce56/Images/Documentation/166e2163-218e-4eec-9ccb-10147212a272.png?sv=2026-02-06&spr=https&st=2026-11-08T09%3A30%3A35Z&se=2026-11-08T10%3A30%3A35Z&sr=c&sp=r&sig=b0EM4Lxkkp7ZTlrP%2FDi5TjCUH8mpbfmaChCGYMrVXIo%3D) Verify peer connection ## Set Keys for Active Directory User - Right-click the user, then click **Edit.** - Choose the **Identity Policy** to use. - Choose the Bucket permissions (Allow create, Allow Delete). - Click on the **Create keys.** > [!NOTE] > ℹ️ Info > > Save the newly generated access and secret keys in a secure location (e.g., a password manager or secrets vault). ![c447f1a2-6144-46c8-94cb-b9f59735e80a.png](https://cdn.us.document360.io/89b91113-5dc6-49db-86ec-57b16dc8ce56/Images/Documentation/c447f1a2-6144-46c8-94cb-b9f59735e80a.png?sv=2026-02-06&spr=https&st=2026-11-08T09%3A30%3A35Z&se=2026-11-08T10%3A30%3A35Z&sr=c&sp=r&sig=b0EM4Lxkkp7ZTlrP%2FDi5TjCUH8mpbfmaChCGYMrVXIo%3D) User details - Click **Update** to complete the operation. > [!NOTE] > ℹ️ Info > > NOTE - The keys will be migrated to the remote (**DR**) cluster; no additional actions are required. ## Enable Identity Policy on the Remote Cluster - Log on to the remote cluster web UI - Go to User Management - Go to Identity Policies - Find the policy you selected on the local cluster and right-click on it - Click Enable to complete the operation ## Initiate FailOver - To initiate FailOver, go to the UI of the remote (DR) cluster. - Go to Data Protection. - Go to Protected Paths. - Right-click on the newly created protected path and select: Replication => **Modify Replication State.** ![672c4027-28da-4b0f-97d3-f6e063e3ce60.png](https://cdn.us.document360.io/89b91113-5dc6-49db-86ec-57b16dc8ce56/Images/Documentation/672c4027-28da-4b0f-97d3-f6e063e3ce60.png?sv=2026-02-06&spr=https&st=2026-11-08T09%3A30%3A35Z&se=2026-11-08T10%3A30%3A35Z&sr=c&sp=r&sig=b0EM4Lxkkp7ZTlrP%2FDi5TjCUH8mpbfmaChCGYMrVXIo%3D) Modify Replication State - Select **FailOver** based on your preference. - **Stand-alone:** Any updates done afterwards at on are not available at . - **Source:** The configured replication interval is x. The estimated Read-Only time is xxx. To reduce the Read-Only time, you may reduce the replication interval. - Click on the **FailOver** button. ![d0b71269-0211-4eea-bed2-47e53d1e3899.png](https://cdn.us.document360.io/89b91113-5dc6-49db-86ec-57b16dc8ce56/Images/Documentation/d0b71269-0211-4eea-bed2-47e53d1e3899.png?sv=2026-02-06&spr=https&st=2026-11-08T09%3A30%3A35Z&se=2026-11-08T10%3A30%3A35Z&sr=c&sp=r&sig=b0EM4Lxkkp7ZTlrP%2FDi5TjCUH8mpbfmaChCGYMrVXIo%3D) Initiate failove - Click **Yes** on the confirmation box. ![6246fe1e-e0d1-4cb5-b83e-3c6d47b21cf5.png](https://cdn.us.document360.io/89b91113-5dc6-49db-86ec-57b16dc8ce56/Images/Documentation/6246fe1e-e0d1-4cb5-b83e-3c6d47b21cf5.png?sv=2026-02-06&spr=https&st=2026-11-08T09%3A30%3A35Z&se=2026-11-08T10%3A30%3A35Z&sr=c&sp=r&sig=b0EM4Lxkkp7ZTlrP%2FDi5TjCUH8mpbfmaChCGYMrVXIo%3D) Confirm initiation of failover - Monitor the **Role** of the protected path and wait until it changes from **Destination** to **Source.** ![678b0afc-ebb5-45a6-9e1f-67ec4fa0e6c4.png](https://cdn.us.document360.io/89b91113-5dc6-49db-86ec-57b16dc8ce56/Images/Documentation/678b0afc-ebb5-45a6-9e1f-67ec4fa0e6c4.png?sv=2026-02-06&spr=https&st=2026-11-08T09%3A30%3A35Z&se=2026-11-08T10%3A30%3A35Z&sr=c&sp=r&sig=b0EM4Lxkkp7ZTlrP%2FDi5TjCUH8mpbfmaChCGYMrVXIo%3D) Monitor failover - Once the failover is completed, the operation is done. > [!NOTE] > ℹ️ Info > > The remote (DR) bucket is always in **ReadOnly** mode, and attempting to write to it will issue “(AccessDenied) when calling the PutObject operation: Access Denied” Error message > [!NOTE] > ℹ️ Info > > Note that FailOver and FailBack are always performed from the “Remote/DR” cluster. ## Client Configuration Notes > [!NOTE] > ℹ️ Info > > Although the above procedure covers the system behavior, client adjustments are required for operational continuity. Follow the baseline instructions below for configuring the client. Given that our production cluster is accessible via the DNS name `s3.prod.vast.local` and our bucket is `prod-bucket`, and that the remote (DR) cluster is accessible via `s3.dr.vast.local`, assuming we've already configured `prod-bucket` to be included in our protected-path (or simply created it under the protected endpoint), all we need to do to establish continuity is to point our application to the new (active) system by updating the S3 endpoint. ### Example (Python with Boto3): **Before (Production):** ```plaintext import boto3 # Connect to production S3 cluster s3_client = boto3.client(    's3',    endpoint_url='http://s3.prod.vast.local',    aws_access_key_id='YOUR_ACCESS_KEY',    aws_secret_access_key='YOUR_SECRET_KEY' ) # Verify bucket access by listing objects response = s3_client.list_objects_v2(Bucket='prod-bucket') for item in response.get('Contents', []):    print(f"Object found: {item['Key']}") ``` **After Failover (DR cluster becomes active):** ```plaintext import boto3 # Connect to the DR S3 cluster s3_client = boto3.client(    's3',    endpoint_url='http://s3.dr.vast.local',  # Update only this line    aws_access_key_id='YOUR_ACCESS_KEY',    aws_secret_access_key='YOUR_SECRET_KEY' ) # Verify bucket access by listing objects response = s3_client.list_objects_v2(Bucket='prod-bucket') for item in response.get('Contents', []):    print(f"Object found: {item['Key']}") ```