Find S3 Cross-Region Replication Rules and What They Cost

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ListBuckets",
      "Effect": "Allow",
      "Action": "s3:ListAllMyBuckets",
      "Resource": "*"
    },
    {
      "Sid": "ReadReplicationAndLocation",
      "Effect": "Allow",
      "Action": ["s3:GetReplicationConfiguration", "s3:GetBucketLocation"],
      "Resource": "arn:aws:s3:::*"
    }
  ]
}

// find-s3-replication-rules.ts
// Lists every S3 replication rule in the account: source and destination Region, storage class,
// Replication Time Control, delete marker replication and filters, flags destinations that no longer
// exist, and estimates the monthly cost of replicating a given volume. Report only.
// Usage: npx tsx find-s3-replication-rules.ts [--gb-per-month 500] [--objects-per-month 200000]
import {
  S3Client,
  GetBucketLocationCommand,
  GetBucketReplicationCommand,
  paginateListBuckets,
  type ReplicationRule,
} from "@aws-sdk/client-s3";

const args = process.argv.slice(2);
const flag = (name: string, fallback: number): number => {
  const i = args.indexOf(name);
  return i >= 0 ? Number(args[i + 1]) : fallback;
};
const gbPerMonth = flag("--gb-per-month", 100);
const objectsPerMonth = flag("--objects-per-month", 100_000);

// List prices from the AWS Price List (September 2026). Transfer rates are for us-east-1 as the source;
// other source Regions charge different rates, so check the S3 pricing page for yours.
const RTC_PER_GB = 0.015;
const PUT_PER_1000 = 0.005;
const STORAGE_PER_GB_MONTH: Record<string, number> = {
  STANDARD: 0.023,
  INTELLIGENT_TIERING: 0.023, // Frequent Access tier; objects move to cheaper tiers later
  STANDARD_IA: 0.0125,
  ONEZONE_IA: 0.01,
  GLACIER_IR: 0.004,
  GLACIER: 0.0036,
};
function transferPerGb(from: string, to: string): number {
  if (from === to) return 0; // Same-Region Replication has no inter-Region transfer charge
  if (from === "us-east-1" && to === "us-east-2") return 0.01;
  return 0.02; // us-east-1 to other US and EU Regions; confirm the rate for other pairs
}

interface Row {
  Source: string;
  Rule: string;
  Destination: string;
  Route: string;
  Class: string;
  RTC: string;
  DeleteMarkers: string;
  Filter: string;
  PerMonth: string;
  Problem: string;
}

const errorText = (err: unknown): string => (err instanceof Error ? `${err.name}: ${err.message}` : String(err));
const clients = new Map<string, S3Client>();
const s3 = (region: string): S3Client => {
  if (!clients.has(region)) clients.set(region, new S3Client({ region }));
  return clients.get(region)!;
};

/** Region of a bucket, "missing" if it no longer exists, "unknown" if we can't tell (for example another account). */
const regionCache = new Map<string, string>();
async function bucketRegion(bucket: string): Promise<string> {
  const cached = regionCache.get(bucket);
  if (cached) return cached;
  let region = "unknown";
  try {
    const res = await s3("us-east-1").send(new GetBucketLocationCommand({ Bucket: bucket }));
    const loc = res.LocationConstraint as string | undefined;
    region = !loc ? "us-east-1" : loc === "EU" ? "eu-west-1" : loc;
  } catch (err) {
    if (err instanceof Error && err.name === "NoSuchBucket") region = "missing";
  }
  regionCache.set(bucket, region);
  return region;
}

function describeFilter(rule: ReplicationRule): string {
  const f = rule.Filter;
  const parts: string[] = [];
  const prefix = f?.Prefix ?? f?.And?.Prefix ?? rule.Prefix;
  if (prefix) parts.push(`prefix ${prefix}`);
  for (const t of [...(f?.Tag ? [f.Tag] : []), ...(f?.And?.Tags ?? [])]) parts.push(`tag ${t.Key}=${t.Value}`);
  return parts.length ? parts.join(", ") : "whole bucket";
}

async function rulesFor(source: string, sourceRegion: string): Promise<Row[]> {
  let rules: ReplicationRule[];
  try {
    const res = await s3(sourceRegion).send(new GetBucketReplicationCommand({ Bucket: source }));
    rules = res.ReplicationConfiguration?.Rules ?? [];
  } catch (err) {
    if (err instanceof Error && err.name === "ReplicationConfigurationNotFoundError") return []; // no replication
    throw err;
  }
  const rows: Row[] = [];
  for (const rule of rules) {
    const destArn = rule.Destination?.Bucket ?? "";
    const destBucket = destArn.replace(/^arn:aws[a-z-]*:s3:::/, "");
    const destRegion = await bucketRegion(destBucket);
    const storageClass = rule.Destination?.StorageClass ?? "STANDARD"; // unset means the source object's class
    const rtc = rule.Destination?.ReplicationTime?.Status === "Enabled";
    const problems: string[] = [];
    if (rule.Status !== "Enabled") problems.push("rule disabled");
    if (destRegion === "missing") problems.push("destination bucket deleted");
    if (rule.Destination?.Account && !rule.Destination.AccessControlTranslation) problems.push("cross-account, no owner override");

    let perMonth = "n/a";
    if (rule.Status === "Enabled" && destRegion !== "missing" && destRegion !== "unknown") {
      const storage = STORAGE_PER_GB_MONTH[storageClass];
      const cost =
        gbPerMonth * (transferPerGb(sourceRegion, destRegion) + (rtc ? RTC_PER_GB : 0)) +
        (objectsPerMonth / 1000) * PUT_PER_1000 +
        (storage === undefined ? 0 : gbPerMonth * storage);
      perMonth = `$${cost.toFixed(2)}${storage === undefined ? " + storage" : ""}`;
    }
    rows.push({
      Source: source,
      Rule: rule.ID ?? "(no id)",
      Destination: destBucket + (rule.Destination?.Account ? ` (${rule.Destination.Account})` : ""),
      Route: `${sourceRegion} -> ${destRegion}`,
      Class: rule.Destination?.StorageClass ?? "same as source",
      RTC: rtc ? "on" : "off",
      DeleteMarkers: rule.DeleteMarkerReplication?.Status ?? "n/a (V1 rule)",
      Filter: describeFilter(rule),
      PerMonth: perMonth,
      Problem: problems.join("; "),
    });
  }
  return rows;
}

async function main(): Promise<void> {
  const rows: Row[] = [];
  for await (const page of paginateListBuckets({ client: s3("us-east-1") }, {})) {
    for (const b of page.Buckets ?? []) {
      if (!b.Name) continue;
      const region = b.BucketRegion ?? (await bucketRegion(b.Name));
      try {
        rows.push(...(await rulesFor(b.Name, region)));
      } catch (err) {
        console.error(`${b.Name}: ${errorText(err)}`);
      }
    }
  }
  if (rows.length === 0) {
    console.log("No bucket in this account has a replication configuration.");
    return;
  }
  console.table(rows);
  console.log(
    `Estimate for ${gbPerMonth} GB and ${objectsPerMonth.toLocaleString("en-US")} new objects per rule per month: ` +
      "inter-Region transfer + RTC + replication PUTs + one month of destination storage (us-east-1 list prices).",
  );
}

main().catch((err) => {
  console.error(errorText(err));
  process.exit(1);
});

npm install @aws-sdk/client-s3
npm install --save-dev tsx typescript @types/node

AWS_PROFILE=readonly npx tsx find-s3-replication-rules.ts --gb-per-month 500 --objects-per-month 200000

┌─────────┬────────────────────┬─────────────────────┬───────────────────────────────────┬──────────────────────────┬──────────────────┬───────┬───────────────┬──────────────────────────────┬──────────┬────────────────────────────────────┐
│ (index) │ Source             │ Rule                │ Destination                       │ Route                    │ Class            │ RTC   │ DeleteMarkers │ Filter                       │ PerMonth │ Problem                            │
├─────────┼────────────────────┼─────────────────────┼───────────────────────────────────┼──────────────────────────┼──────────────────┼───────┼───────────────┼──────────────────────────────┼──────────┼────────────────────────────────────┤
│ 0       │ 'acme-app-uploads' │ 'uploads-to-oregon' │ 'acme-app-uploads-usw2'           │ 'us-east-1 -> us-west-2' │ 'same as source' │ 'on'  │ 'Disabled'    │ 'whole bucket'               │ '$30.00' │ ''                                 │
│ 1       │ 'acme-logs'        │ 'logs-to-audit'     │ 'audit-archive-eu (210987654321)' │ 'us-east-1 -> unknown'   │ 'GLACIER_IR'     │ 'off' │ 'Disabled'    │ 'prefix cloudtrail/'         │ 'n/a'    │ 'cross-account, no owner override' │
│ 2       │ 'acme-logs'        │ 'logs-to-ohio'      │ 'acme-logs-use2'                  │ 'us-east-1 -> us-east-2' │ 'STANDARD_IA'    │ 'off' │ 'Disabled'    │ 'prefix app/, tag keep=true' │ '$12.25' │ ''                                 │
│ 3       │ 'acme-backups'     │ 'backups-dr'        │ 'acme-backups-dr-old'             │ 'us-east-1 -> missing'   │ 'GLACIER'        │ 'off' │ 'Enabled'     │ 'whole bucket'               │ 'n/a'    │ 'destination bucket deleted'       │
└─────────┴────────────────────┴─────────────────────┴───────────────────────────────────┴──────────────────────────┴──────────────────┴───────┴───────────────┴──────────────────────────────┴──────────┴────────────────────────────────────┘
Estimate for 500 GB and 200,000 new objects per rule per month: inter-Region transfer + RTC + replication PUTs + one month of destination storage (us-east-1 list prices).