Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 80.92%. Comparing base (4d9a0c2) to head (dba5d71).

@@           Coverage Diff           @@
##             main   #33360   +/-   ##
=======================================
  Coverage   80.92%   80.92%           
=======================================
  Files         236      236           
  Lines       14253    14253           
  Branches     2490     2490           
=======================================
  Hits        11534    11534           
  Misses       2434     2434           
  Partials      285      285           

AWS CodeBuild CI Report

• CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
• Commit ID: dba5d71
• Result: SUCCEEDED
• Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

How does this work in a scenario where multiple stages are deployed to 1 account? So we have 2 buckets from the TEST stage being replicated and 2 buckets from the PRD stage being replicated? Will they use the same role? And what if the replication is cross-account?

I was more thinking along the lines of adding an optional replicationRole: Role property to the ReplicationRule interface and use that role if it is passed in. That gives the control to the user on when to use the same and when to use different roles. The destination bucket already allows the user to specify the role (ARN) in the addReplicationPolicy method. Or possibly refactor renderReplicationConfiguration so that the part that creates the policy for the source bucket becomes a public method to allow people to set up permissions easily when they cutomize their stack (similar to how the addReplicationPolicy method is public for the destination bucket).

BTW, https://github.com/aws/aws-cdk/blob/main/packages/aws-cdk-lib/aws-s3/lib/bucket.ts#L2853 appears to be confusing the buckets: addReplicationPolicy() can be used to set permissions on the destination bucket.