1. Grant the Amazon S3 permissions that the CMS needs.

   See Granting Required S3 Permissions.

2. Prepare the AWS resources for your authentication type. Choose one of the following:

   Authentication Type	Action
   Keys	Skip this step.
   IAM Role Attachment	See Preparing AWS for IAM Role Attachment.
   IAM Roles Anywhere	See Preparing AWS for IAM Roles Anywhere.

3. Add or edit the Amazon AWS S3 replication target in the CMS.

   See Adding Amazon AWS S3 Replication Targets.

1. In the IAM console, create a permissions policy that grants the Amazon S3 actions.

   Use a policy similar to the following. Replace amzn-s3-demo-bucket with your bucket name.

   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Sid": "ListReplicationBucket",
         "Effect": "Allow",
         "Action": "s3:ListBucket",
         "Resource": "arn:aws:s3:::amzn-s3-demo-bucket"
       },
       {
         "Sid": "WriteReplicationObjects",
         "Effect": "Allow",
         "Action": [
           "s3:PutObject",
           "s3:DeleteObject"
         ],
         "Resource": "arn:aws:s3:::amzn-s3-demo-bucket/*"
       }
     ]
   }

   Note

   s3:ListBucket applies to the bucket ARN, while s3:PutObject and s3:DeleteObject apply to the objects in the bucket (/*). If the bucket uses server-side encryption with a customer managed AWS Key Management Service (AWS KMS) key, the role also needs permission to use that key. See Required permissions for Amazon S3 API operations for details.
2. Attach the policy to the IAM principal based on the authentication type that the CMS uses.
   Keys

   Attach the policy to the IAM user whose access key and secret key the CMS uses.

   IAM Role Attachment

   Attach the policy to the replication role when you create the role in the next task.

   IAM Roles Anywhere

   Attach the policy to the replication role when you create the role in the next task.

1. In the IAM console, create the replication role.

   For example, name the role IngeniuxS3Replication.

2. Attach the permissions policy from Granting Required S3 Permissions to the replication role.
3. Set the replication role's Maximum session duration to 12 hours.

   The CMS requests a 12-hour session. If the role's maximum session duration is lower, AWS rejects the request. See Update the maximum session duration for a role for details.

4. Edit the replication role's trust policy so that the instance role can assume the replication role.

   Replace the example ARN with your instance role's ARN.

   Example ARN for instance role

   {
                   "Version": "2012-10-17",
                   "Statement": [
                   {
                   "Effect": "Allow",
                   "Principal": { "AWS": "arn:aws:iam::111122223333:role/CmsEc2InstanceRole" },
                   "Action": "sts:AssumeRole"
                   }
                   ]
                   }

5. Add a permissions policy to the instance role that allows the instance role to assume the replication role.

   Replace the example ARN with your replication role's ARN.

   Example ARN for replication role

   {
                   "Version": "2012-10-17",
                   "Statement": [
                   {
                   "Effect": "Allow",
                   "Action": "sts:AssumeRole",
                   "Resource": "arn:aws:iam::111122223333:role/IngeniuxS3Replication"
                   }
                   ]
                   }

6. Copy the replication role's ARN.

   You enter this ARN in the IAM Role ARN field when you add the replication target.

1. In the IAM Roles Anywhere console, create a trust anchor that references your CA.
   Note

   You configure the CA certificate in the trust anchor in AWS. Don't upload the CA certificate to the CMS.
2. Copy the trust anchor ARN.
3. In the IAM console, create the replication role.
4. Attach the permissions policy from Granting Required S3 Permissions to the replication role.
5. Edit the replication role's trust policy to trust IAM Roles Anywhere through your trust anchor.

   Replace the example ARN with your trust anchor ARN.

   Example ARN for trust anchor

   {
                   "Version": "2012-10-17",
                   "Statement": [
                   {
                   "Effect": "Allow",
                   "Principal": { "Service": "rolesanywhere.amazonaws.com" },
                   "Action": [
                   "sts:AssumeRole",
                   "sts:TagSession",
                   "sts:SetSourceIdentity"
                   ],
                   "Condition": {
                   "ArnEquals": {
                   "aws:SourceArn": "arn:aws:rolesanywhere:us-west-2:111122223333:trust-anchor/a1b2c3d4-5678-90ab-cdef-EXAMPLE11111"
                   }
                   }
                   }
                   ]
                   }

   Tip

   AWS recommends adding conditions on the certificate's subject and issuer so that only the CMS server's certificate can assume the role. See IAM Roles Anywhere trust model for examples.
6. In the IAM Roles Anywhere console, create a profile that includes the replication role.
7. Copy the profile ARN.

   You now have the replication role ARN, trust anchor ARN, and profile ARN. Enter these values, along with the certificate and private key, when you add the replication target.

1. In the Replication tab, expand the Amazon AWS S3 replication target.
2. In Name, enter a name for the replication target.
3. Optional: In Description, enter a description of the replication target.
4. From the Region End Point drop-down list, select the region endpoint.

   The region endpoint is the URL that serves as the entry point for the web service. Resources in each region are independent.

5. In Bucket, enter the bucket name.

   Bucket names are globally unique, regardless of the AWS Region that contains the bucket.

6. From the Authentication Type drop-down list, select the authentication type.

   The default is Keys. The fields that display next depend on the authentication type you select.

7. Enter the credentials for the selected authentication type:
   Keys

   Field	Description
   Access Key	A 20-character alphanumeric string, such as AKIAIOSFODNN7EXAMPLE
   Secret Key	A 40-character string, such as wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEK

   

   IAM Role Attachment

   Field	Description
   IAM Role ARN	The replication role's ARN, such as arn:aws:iam::111122223333:role/IngeniuxS3Replication

   

   Version Notes: CMS 10.6

   This authentication type is only available in CMS 10.6.

   IAM Roles Anywhere

   Field	Description
   IAM Role ARN	The replication role's ARN, such as arn:aws:iam::111122223333:role/IngeniuxS3Replication
   IAM Role Anywhere Trust Anchor ARN	The trust anchor ARN
   IAM Role Anywhere Profile ARN	The profile ARN
   IAM Role Anywhere Certificate	Click Upload, then select the CMS server's certificate file in PEM format (.pem or .txt).
   IAM Role Anywhere Private Key	Click Upload, then select the matching private key file in PEM format (.pem or .txt).

   The CMS encrypts and stores the uploaded certificate and private key.

   

   Version Notes: CMS 10.6

   This authentication type is only available in CMS 10.6.
8. In Root Path, enter the replication location, starting with a forward slash (/).

   The root path begins at the root of the AWS site and uses forward slashes as delimiters. You can create a new folder for the root path.

9. Click Save in the top-right corner of the Manage Publishing Targets pane.

Next Steps: To configure exempt locations, additional locations, cleanup exclusions, and custom commands for the replication target, see Advanced Settings.