S3 versioning, lifecycle rules and replication

Sign in and set up names for a source bucket in Mumbai and a destination in Singapore:

cd C:\aws-lab
aws login --profile saat-admin
$env:AWS_PROFILE = 'saat-admin'
$acct = aws sts get-caller-identity --query Account --output text
$src = "saat-src-$acct-ap-south-1-an"
$dst = "saat-dst-$acct-ap-southeast-1-an"
aws s3api create-bucket --bucket $src --bucket-namespace account-regional --region ap-south-1 --create-bucket-configuration LocationConstraint=ap-south-1 | Out-Null
aws s3api put-bucket-versioning --bucket $src --versioning-configuration Status=Enabled
aws s3api get-bucket-versioning --bucket $src --query Status --output text

You should see this:

Enabled

1Overwrite a file and read the old version

Paste this whole block:

Set-Content config.txt "max_connections=100"
aws s3 cp config.txt "s3://$src/config.txt" | Out-Null
Set-Content config.txt "max_connections=500"
aws s3 cp config.txt "s3://$src/config.txt" | Out-Null
aws s3api list-object-versions --bucket $src --prefix config.txt --query "Versions[].[VersionId,IsLatest,Size]" --output text
$old = aws s3api list-object-versions --bucket $src --prefix config.txt --query 'Versions[?IsLatest==`false`].VersionId | [0]' --output text
aws s3api get-object --bucket $src --key config.txt --version-id $old old-config.txt | Out-Null
Get-Content old-config.txt

You should see something like this:

Xb8n3Lq2Vt7Rw1Zp9Ks4Mc6Jd0Hf5Ga.  True    21
0pQ7Tz4Wn9Lk2Rs6Vb1Xm8Yc3Jd5Hf0E   False   21
max_connections=100

The overwrite didn’t lose anything. Version 1 is still there and you just downloaded it by its version ID.

2Delete the file, then bring it back

Paste this whole block:

aws s3 rm "s3://$src/config.txt"
aws s3 ls "s3://$src/"
aws s3api list-object-versions --bucket $src --prefix config.txt --query "DeleteMarkers[].[VersionId,IsLatest]" --output text
$marker = aws s3api list-object-versions --bucket $src --prefix config.txt --query "DeleteMarkers[0].VersionId" --output text
aws s3api delete-object --bucket $src --key config.txt --version-id $marker | Out-Null
aws s3 ls "s3://$src/"

You should see something like this (the first ls prints nothing):

delete: s3://saat-src-111122223333-ap-south-1-an/config.txt
mQ3tVq8Lp0aZ.4kXvR9sTn2YbWc6HdEf      True
2026-10-20 16:02:18         21 config.txt

The “deleted” file is back. This is the five-minute fix for most “I deleted the wrong thing” calls, but only on buckets where versioning was on before the delete.

3Add lifecycle rules

Paste this whole block:

@'
{
  "Rules": [
    {
      "ID": "logs-tiering",
      "Status": "Enabled",
      "Filter": { "Prefix": "logs/" },
      "Transitions": [
        { "Days": 30, "StorageClass": "STANDARD_IA" },
        { "Days": 90, "StorageClass": "GLACIER_IR" }
      ],
      "Expiration": { "Days": 365 }
    },
    {
      "ID": "cleanup-versions",
      "Status": "Enabled",
      "Filter": {},
      "NoncurrentVersionExpiration": { "NoncurrentDays": 30, "NewerNoncurrentVersions": 3 },
      "Expiration": { "ExpiredObjectDeleteMarker": true },
      "AbortIncompleteMultipartUpload": { "DaysAfterInitiation": 7 }
    }
  ]
}
'@ | Set-Content lifecycle.json
aws s3api put-bucket-lifecycle-configuration --bucket $src --lifecycle-configuration file://lifecycle.json
aws s3api get-bucket-lifecycle-configuration --bucket $src --query "Rules[].[ID,Status]" --output text

You should see this:

logs-tiering    Enabled
cleanup-versions        Enabled

Nothing moves today: the rules act on objects as they age, and S3 checks about once a day. In a real bucket you’d see the transitions in Storage Lens or the bill after a month.

4Replicate to Singapore

Paste this whole block. It creates the destination bucket with versioning, a replication role and the rule:

aws s3api create-bucket --bucket $dst --bucket-namespace account-regional --region ap-southeast-1 --create-bucket-configuration LocationConstraint=ap-southeast-1 | Out-Null
aws s3api put-bucket-versioning --bucket $dst --region ap-southeast-1 --versioning-configuration Status=Enabled
'{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Service": "s3.amazonaws.com" }, "Action": "sts:AssumeRole" } ] }' | Set-Content repl-trust.json
@'
{
  "Version": "2012-10-17",
  "Statement": [
    { "Effect": "Allow", "Action": ["s3:GetReplicationConfiguration", "s3:ListBucket"], "Resource": "arn:aws:s3:::SRC" },
    { "Effect": "Allow", "Action": ["s3:GetObjectVersionForReplication", "s3:GetObjectVersionAcl", "s3:GetObjectVersionTagging"], "Resource": "arn:aws:s3:::SRC/*" },
    { "Effect": "Allow", "Action": ["s3:ReplicateObject", "s3:ReplicateDelete", "s3:ReplicateTags"], "Resource": "arn:aws:s3:::DST/*" }
  ]
}
'@ -replace 'SRC', $src -replace 'DST', $dst | Set-Content repl-policy.json
$roleArn = aws iam create-role --role-name saat-s3-replication --assume-role-policy-document file://repl-trust.json --query Role.Arn --output text
aws iam put-role-policy --role-name saat-s3-replication --policy-name replicate --policy-document file://repl-policy.json
@'
{
  "Role": "ROLE_ARN",
  "Rules": [
    {
      "ID": "all-to-singapore",
      "Status": "Enabled",
      "Priority": 1,
      "Filter": {},
      "DeleteMarkerReplication": { "Status": "Disabled" },
      "Destination": { "Bucket": "arn:aws:s3:::DST" }
    }
  ]
}
'@ -replace 'ROLE_ARN', $roleArn -replace 'DST', $dst | Set-Content replication.json
Start-Sleep 15
aws s3api put-bucket-replication --bucket $src --replication-configuration file://replication.json
'{ "order": "o-1001", "amount": 2499 }' | Set-Content o-1001.json
aws s3 cp o-1001.json "s3://$src/orders/o-1001.json" | Out-Null
do { Start-Sleep 10; $st = aws s3api head-object --bucket $src --key orders/o-1001.json --query ReplicationStatus --output text } until ($st -ne 'PENDING')
$st
aws s3api head-object --bucket $dst --key orders/o-1001.json --region ap-southeast-1 --query ReplicationStatus --output text

You should see this (usually within a minute):

COMPLETED
REPLICA

The source says COMPLETED and the copy in Singapore says REPLICA. Now check config.txt, which existed before the rule:

aws s3 ls "s3://$dst/" --region ap-southeast-1 --recursive

You should see something like this:

2026-10-20 16:09:44         39 orders/o-1001.json

Only the new object is there. Replication never copies objects that existed before the rule; for those you’d run S3 Batch Replication.

✅ Checkpoint: You restored an overwritten and a deleted file from versions, two lifecycle rules are Enabled, and orders/o-1001.json is REPLICA in Singapore. Keep everything for the break lab.