Help Center/ Object Storage Service/ User Guide/ Data Management/ Data Replication/ Cross-Account, Same-Region Replication Using OMS
Updated on 2026-09-23 GMT+08:00

Cross-Account, Same-Region Replication Using OMS

Scenarios

Same-region replication across accounts is to replicate data from a source bucket in one region of an account to a destination bucket in the same region of another account.

This section describes how to replicate data between buckets in the same region across accounts using the OMS console, OMS APIs, OBS APIs, OBS SDKs, or obsutil.

Replication scope: files/folders, object lists, objects matching a specified prefix, and objects modified after a specified time

Replication content: object content, metadata (object name, size, last modification time, creator, version ID, and user-defined metadata), ACLs (supported by OBS APIs and obsutil), WORM retention policies (supported by OBS APIs), object tags (supported by OBS APIs), and storage class

Figure 1 Same-region replication across accounts

OBS helps you replicate your service data stored in OBS to another bucket in the same region. However, Huawei Cloud does not have visibility into your data and is not responsible for ensuring the legal compliance of your use of OBS.

Constraints

Billing for Same-Region Replication Across Accounts

  • When you use the OMS console or APIs to migrate data, OBS APIs of both the source and destination ends are invoked to handle data upload and download. You will be billed for the API requests and data download traffic. For details, see OMS Billing. In addition, you will be billed for storing the objects in the destination bucket. For details, see Storage Costs.
  • When you use OBS APIs, OBS SDKs, or obsutil to replicate data within the same region, you will be billed for requests and storage. For details, see Table 1.
    Table 1 Billing for same-region replication

    Action

    Billing Item

    Description

    Billing Mode

    Replicate data in the same region

    Requests

    You are billed for the number of successfully replicated objects. Successfully replicating one object creates a copy request. For details, see Copying Objects.

    Replicating an object generates a GET request to the source bucket and a PUT request to the destination bucket.

    For details about request billing, see Requests.

    Pay-per-use

    Data transfer

    Free, because data in the same region is replicated over an intranet.

    N/A

    Storage space

    Storage space occupied by objects stored in the destination bucket.

    If you have specified another storage class for object copies in the destination bucket, these copies are billed based on the new storage class.

    Pay-per-use

    Resource packages

Prerequisites

  • There is a source bucket in a region of an account.
  • There is a destination bucket in the same region of a different account. To create a bucket, see Creating a Bucket.

Procedure

Step 1: Configure a Bucket Policy

To perform cross-account, same-region replication, you must grant the destination account the read access to the source bucket and write access to the destination bucket. You can use bucket policies to grant access.

Configure a source bucket policy to allow the destination account to read data from the source bucket.

  1. Log in to OBS Console using account A (the account that owns the source bucket).
  2. In the bucket list, click the source bucket name to go to the details page.
  3. In the navigation pane, choose Permissions > Bucket Policies.
  4. Click Create. On the displayed page, create a bucket policy using either the visual editor or JSON mode.

    • Create a bucket policy in the visual editor. For details about parameter settings, see Table 2.
      Table 2 Creating a source bucket policy in the visual editor

      Parameter

      Description

      Policy Name

      Define a name based on your service requirements.

      Effect

      Allow: The policy allows the matched requests.

      Principal

      Select Other accounts. Enter the ID of the destination account for replication and the IAM user ID or IAM username.

      Resources

      Select Entire bucket (including the objects in it).

      Actions

      Select Use a template and Bucket Read-Only.

      Conditions

      Do not configure it (defaults to all).

    • Create a bucket policy in JSON format:
      {
          "Statement": [
              {
                  "Sid": "<bucket-policy-name>",
                  "Effect": "Allow",
                  "Principal": {
                      "ID": [
                          "domain/account-ID/<IAM-user-ID>"
                      ]
                  },
                  "Action": [
                      "Get*",
                      "List*",
                      "HeadBucket"
                  ],
                  "Resource": [
                      "<source-bucket-name>",
                      "<source-bucket-name>/*"
                  ]
              }
          ]
      }

  5. Click Create. The source bucket's read policy is created.

Configure a destination bucket policy to grant the destination account write access to the destination bucket.

If account B (the destination account) owns the destination bucket, you do not need to configure a bucket policy. By default, the bucket owner has read/write permissions for the bucket. If the destination bucket is not owned by account B (the destination account), perform the following operations to grant the destination account write access to the destination bucket:

  1. Log in to OBS Console using the destination account.
  2. In the bucket list, click the destination bucket name to go to the details page.
  3. In the navigation pane, choose Permissions > Bucket Policies.
  4. Click Create. On the displayed page, create a bucket policy using either the visual editor or JSON mode.

    • Create a bucket policy in the visual editor. For details about parameter settings, see Table 3.
      Table 3 Creating a destination bucket policy in the visual editor

      Parameter

      Description

      Policy Name

      Define a name based on your service requirements.

      Effect

      Allow: The policy allows the matched requests.

      Principal

      Select Other accounts. Enter the ID of the destination account for replication and the IAM user ID or IAM username.

      Resources

      Select Entire bucket (including the objects in it).

      Actions

      Select Use a template and Bucket Read/Write.

      Conditions

      Do not configure it (defaults to all).

    • Create a bucket policy in JSON format:
      {
          "Statement": [
              {
                  "Sid": "<bucket-policy-name>",
                  "Effect": "Allow",
                  "Principal": {
                      "ID": [
                          "domain/account-ID/<IAM-user-ID>"
                      ]
                  },
                  "NotAction": [
                      "DeleteBucket",
                      "PutBucketPolicy",
                      "PutBucketAcl"
                  ],
                  "Resource": [
                      "destination-bucket-name",
                      "destination-bucket-name/*"
                  ]
              }
          ]
      }

  5. Click Create. The write policy for the destination bucket is created.