---
title: "S3 Synchronous Replication with Active-Directory Users and Identity Policy"
slug: "s3-synchronous-replication-with-active-directory-users-and-identity-policy"
description: "Configure synchronous S3 replication with Active Directory users and identity policies in VAST 5.2+. Follow clear steps for seamless setup and management."
updated: 2026-10-28T18:40:50Z
published: 2026-10-28T18:40:50Z
canonical: "docs.vastdata.com/s3-synchronous-replication-with-active-directory-users-and-identity-policy"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.vastdata.com/llms.txt
> Use this file to discover all available pages before exploring further.

# S3 Synchronous Replication with Active-Directory Users and Identity Policy

> [!NOTE]
> ℹ️ Info
> 
> This document is intended to provide clear instructions for configuring synchronous S3 replication using Active-Directory users and identity policies. The steps listed in this procedure have been tested on VAST 5.2 and above.

## Enable S3 Bucket Replication

**This action needs to be done on both clusters**

- From the VAST UI, go to **Settings.**
- Click **S3,** then **enable** **Bucket Replication.**

![31901546-96d1-44b2-8b9d-5927d4c98a9f.png](https://cdn.us.document360.io/89b91113-5dc6-49db-86ec-57b16dc8ce56/Images/Documentation/31901546-96d1-44b2-8b9d-5927d4c98a9f.png?sv=2026-02-06&spr=https&st=2026-11-08T09%3A44%3A21Z&se=2026-11-08T10%3A44%3A21Z&sr=c&sp=r&sig=dGcQHGt6mql54c0Nf3L8nAyE%2Bgtknnb7od3M0wYtIVs%3D)

Enable Bucket Replication.

> [!NOTE]
> ℹ️ Info
> 
> You will be prompted to enable the replication. Note that this option is not reversible.

![5aed9240-2e98-4bdc-b004-bf8933e2dfea.png](https://cdn.us.document360.io/89b91113-5dc6-49db-86ec-57b16dc8ce56/Images/Documentation/5aed9240-2e98-4bdc-b004-bf8933e2dfea.png?sv=2026-02-06&spr=https&st=2026-11-08T09%3A44%3A21Z&se=2026-11-08T10%3A44%3A21Z&sr=c&sp=r&sig=dGcQHGt6mql54c0Nf3L8nAyE%2Bgtknnb7od3M0wYtIVs%3D)

Confirm that Bucket Replication is enabled.

### Create an Identity Policy

- Log in to the VAST UI.
- Go to **User Management.**
- Click on **Identity Policy.**
- Click on **Create Policy,** type a name for the new policy, and set the policy definition. The policy definition can be done using the **Action** and **Resource** drop-down menu or by using the JSON code box.

You can use the JSON example below to set the policy.

![f34be54d-eead-4120-a408-eccb45ba052e.png](https://cdn.us.document360.io/89b91113-5dc6-49db-86ec-57b16dc8ce56/Images/Documentation/f34be54d-eead-4120-a408-eccb45ba052e.png?sv=2026-02-06&spr=https&st=2026-11-08T09%3A44%3A21Z&se=2026-11-08T10%3A44%3A21Z&sr=c&sp=r&sig=dGcQHGt6mql54c0Nf3L8nAyE%2Bgtknnb7od3M0wYtIVs%3D)

Create an identity policy

JSON policy definition example

```plaintext
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:*"
      ],
      "Resource": "*"
    }
  ]
}
```

> [!NOTE]
> ℹ️ Info
> 
> NOTE - The identity policy is automatically replicated to the DR(remote) cluster, but in **Disabled** mode, please manually enable it.

### Configure Active-Directory

- Log in to VAST UI.
- Go to **User Management.**
- Go to the **Active Directory** tab.
- Click on the **Create Active Directory** button.
- Fill all required fields with your Active Directory details.

![2c49ca36-fb8a-4841-8959-2fbdaf267f3f.png](https://cdn.us.document360.io/89b91113-5dc6-49db-86ec-57b16dc8ce56/Images/Documentation/2c49ca36-fb8a-4841-8959-2fbdaf267f3f.png?sv=2026-02-06&spr=https&st=2026-11-08T09%3A44%3A21Z&se=2026-11-08T10%3A44%3A21Z&sr=c&sp=r&sig=dGcQHGt6mql54c0Nf3L8nAyE%2Bgtknnb7od3M0wYtIVs%3D)

Configure Active-Directory

- Click on **Create.**
- Wait for the newly created Active Directory status to change to **Connected.**
- Right-click on the Active Directory and choose **Join.**
- Fill in the user and password and click **Join.**

![1b8130c8-ef88-4f08-8c4e-2a76073b8e7a.png](https://cdn.us.document360.io/89b91113-5dc6-49db-86ec-57b16dc8ce56/Images/Documentation/1b8130c8-ef88-4f08-8c4e-2a76073b8e7a.png?sv=2026-02-06&spr=https&st=2026-11-08T09%3A44%3A21Z&se=2026-11-08T10%3A44%3A21Z&sr=c&sp=r&sig=dGcQHGt6mql54c0Nf3L8nAyE%2Bgtknnb7od3M0wYtIVs%3D)

Join Active Directory

## Configure Active-Directory User on VAST Cluster

- Go to the **Users** tab.
- Click on the query button in the upper right corner of the screen.

![4cab92bc-6dd6-4f45-874d-62772212d48b.png](https://cdn.us.document360.io/89b91113-5dc6-49db-86ec-57b16dc8ce56/Images/Documentation/4cab92bc-6dd6-4f45-874d-62772212d48b.png?sv=2026-02-06&spr=https&st=2026-11-08T09%3A44%3A21Z&se=2026-11-08T10%3A44%3A21Z&sr=c&sp=r&sig=dGcQHGt6mql54c0Nf3L8nAyE%2Bgtknnb7od3M0wYtIVs%3D)

Configure Active-Directory User on VAST Cluster

- Enter a username and click the **Query** button.

![6339528a-2682-4603-b3d1-b63830fd8a38.png](https://cdn.us.document360.io/89b91113-5dc6-49db-86ec-57b16dc8ce56/Images/Documentation/6339528a-2682-4603-b3d1-b63830fd8a38.png?sv=2026-02-06&spr=https&st=2026-11-08T09%3A44%3A21Z&se=2026-11-08T10%3A44%3A21Z&sr=c&sp=r&sig=dGcQHGt6mql54c0Nf3L8nAyE%2Bgtknnb7od3M0wYtIVs%3D)

Query Active Directory

- The windows will be closed, and the user's view will change to display the selected Active Directory user.

## Set Keys for Active-Directory User

- Right-click on the user and click **Edit.**
- Choose the **Identity Policy** to use.
- Choose Bucket permissions (Allow create, Allow Delete).
- Click on the **Create keys.**

> [!NOTE]
> ℹ️ Info
> 
> Save the newly generated access and secret keys in a secure location (e.g., a password manager or secrets vault).

![24a5eaf0-84e4-4808-af37-d3b02152fca4.png](https://cdn.us.document360.io/89b91113-5dc6-49db-86ec-57b16dc8ce56/Images/Documentation/24a5eaf0-84e4-4808-af37-d3b02152fca4.png?sv=2026-02-06&spr=https&st=2026-11-08T09%3A44%3A21Z&se=2026-11-08T10%3A44%3A21Z&sr=c&sp=r&sig=dGcQHGt6mql54c0Nf3L8nAyE%2Bgtknnb7od3M0wYtIVs%3D)

Set Keys for Active-Directory User

- That will look like the following.

![869db9e4-4bdf-4816-a4f5-f95fa513edfa.png](https://cdn.us.document360.io/89b91113-5dc6-49db-86ec-57b16dc8ce56/Images/Documentation/869db9e4-4bdf-4816-a4f5-f95fa513edfa.png?sv=2026-02-06&spr=https&st=2026-11-08T09%3A44%3A21Z&se=2026-11-08T10%3A44%3A21Z&sr=c&sp=r&sig=dGcQHGt6mql54c0Nf3L8nAyE%2Bgtknnb7od3M0wYtIVs%3D)

Example of Set Keys for Active-Directory User

- Click **Update** to complete the operation.

> [!NOTE]
> ℹ️ Info
> 
> NOTE: The keys will be migrated to the remote (**DR**) cluster; no additional actions are required.

## Set the Active-Directory User as the Bucket Owner

- In the VAST UI, navigate to the **Element Store** and to the **View menu.**

![2b62d8c5-43bd-48c4-a2a2-0a7c40a5becc.png](https://cdn.us.document360.io/89b91113-5dc6-49db-86ec-57b16dc8ce56/Images/Documentation/2b62d8c5-43bd-48c4-a2a2-0a7c40a5becc.png?sv=2026-02-06&spr=https&st=2026-11-08T09%3A44%3A21Z&se=2026-11-08T10%3A44%3A21Z&sr=c&sp=r&sig=dGcQHGt6mql54c0Nf3L8nAyE%2Bgtknnb7od3M0wYtIVs%3D)

Navigate to the Element Store

- Right-click on the **View** you want to edit.
- In the S3 section, add/set the Active Directory user.

![aee3ac0b-a8ad-4497-9c13-849ad972b994.png](https://cdn.us.document360.io/89b91113-5dc6-49db-86ec-57b16dc8ce56/Images/Documentation/aee3ac0b-a8ad-4497-9c13-849ad972b994.png?sv=2026-02-06&spr=https&st=2026-11-08T09%3A44%3A21Z&se=2026-11-08T10%3A44%3A21Z&sr=c&sp=r&sig=dGcQHGt6mql54c0Nf3L8nAyE%2Bgtknnb7od3M0wYtIVs%3D)

add/set the Active Directory user

- Click “**Update**” to complete the operation.
- Configure Protected Path.

## Configure Protected Path

- From the VAST UI, navigate to **Data Protection.**
- Click on **Protected Path.**
- Click on **Create Protected Path** and choose **New Remote Protected Path.**

![87fd99f2-3a12-49e6-802d-707ebbfe596e.png](https://cdn.us.document360.io/89b91113-5dc6-49db-86ec-57b16dc8ce56/Images/Documentation/87fd99f2-3a12-49e6-802d-707ebbfe596e.png?sv=2026-02-06&spr=https&st=2026-11-08T09%3A44%3A21Z&se=2026-11-08T10%3A44%3A21Z&sr=c&sp=r&sig=dGcQHGt6mql54c0Nf3L8nAyE%2Bgtknnb7od3M0wYtIVs%3D)

New Remote Protected Path

- **Name** the new protected path and fill the **Path** field.
- Note that you can set the path to a specific bucket or to an endpoint. In this example, we’ve pointed to an endpoint, so every bucket created under this endpoint will be included in the replication.

![9ccf46e7-c243-40d7-a60c-127baf659171.png](https://cdn.us.document360.io/89b91113-5dc6-49db-86ec-57b16dc8ce56/Images/Documentation/9ccf46e7-c243-40d7-a60c-127baf659171.png?sv=2026-02-06&spr=https&st=2026-11-08T09%3A44%3A21Z&se=2026-11-08T10%3A44%3A21Z&sr=c&sp=r&sig=dGcQHGt6mql54c0Nf3L8nAyE%2Bgtknnb7od3M0wYtIVs%3D)

Create a remote protected path

- Click **Next.**
- Fill in the necessary details for the remote site, as shown in the example below.

![478766da-568d-47fb-b59d-2e3981bf0145.png](https://cdn.us.document360.io/89b91113-5dc6-49db-86ec-57b16dc8ce56/Images/Documentation/478766da-568d-47fb-b59d-2e3981bf0145.png?sv=2026-02-06&spr=https&st=2026-11-08T09%3A44%3A21Z&se=2026-11-08T10%3A44%3A21Z&sr=c&sp=r&sig=dGcQHGt6mql54c0Nf3L8nAyE%2Bgtknnb7od3M0wYtIVs%3D)

Enter details for new Remote Protected Path

- Click **Add.**
- Set the connectivity timeout.

![421ad42e-bbdb-4656-a3d8-86a37fed4cf2.png](https://cdn.us.document360.io/89b91113-5dc6-49db-86ec-57b16dc8ce56/Images/Documentation/421ad42e-bbdb-4656-a3d8-86a37fed4cf2.png?sv=2026-02-06&spr=https&st=2026-11-08T09%3A44%3A21Z&se=2026-11-08T10%3A44%3A21Z&sr=c&sp=r&sig=dGcQHGt6mql54c0Nf3L8nAyE%2Bgtknnb7od3M0wYtIVs%3D)

Set the connectivity timeout

- Click **Add.**
- Click **Create** to complete the operation.

![69e6e902-3c97-4d44-833f-c07ae15dc2c7.png](https://cdn.us.document360.io/89b91113-5dc6-49db-86ec-57b16dc8ce56/Images/Documentation/69e6e902-3c97-4d44-833f-c07ae15dc2c7.png?sv=2026-02-06&spr=https&st=2026-11-08T09%3A44%3A21Z&se=2026-11-08T10%3A44%3A21Z&sr=c&sp=r&sig=dGcQHGt6mql54c0Nf3L8nAyE%2Bgtknnb7od3M0wYtIVs%3D)

Create to complete the operation

- Wait until the replication state becomes **Active.**

> [!NOTE]
> ℹ️ Info
> 
> At the point the replication is configured and the bucket can be accessed on each cluster with the same keys.