PutBucketReplication operation: Access Denied using boto3 - amazon-web-services

Question

Below are my configurations and I'm still getting Access Denied excpetion while trying to do PutBucketReplication from a lambda.
Replication role policy:
{
"Version": "2012-10-17",
"Statement": [
{
"Action": [
"s3:ListBucket",
"s3:GetReplicationConfiguration",
"s3:GetObjectVersionForReplication",
"s3:GetObjectVersionAcl",
"s3:GetObjectVersionTagging",
"s3:GetObjectRetention",
"s3:GetObjectLegalHold"
],
"Effect": "Allow",
"Resource": [
"arn:aws:s3:::<source bucket>",
"arn:aws:s3:::<source bucket>/*",
"arn:aws:s3:::<destination bucket>",
"arn:aws:s3:::<destination bucket>/*"
]
},
{
"Action": [
"s3:ReplicateObject",
"s3:ReplicateDelete",
"s3:ReplicateTags",
"s3:ObjectOwnerOverrideToBucketOwner"
],
"Effect": "Allow",
"Resource": [
"arn:aws:s3:::<source bucket>/*",
"arn:aws:s3:::<destination bucket>/*"
]
}
]
}
Lambda Role policy:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "logs:CreateLogGroup",
"Resource": "arn:aws:logs:us-west-2:<source account>:*"
},
{
"Effect": "Allow",
"Action": [
"logs:CreateLogStream",
"logs:PutLogEvents"
],
"Resource": [
"arn:aws:logs:us-west-2:<source account>:log-group:/aws/lambda/PutReplicationFunction:*"
]
},
{
"Effect": "Allow",
"Action": "s3:*",
"Resource": "arn:aws:s3:::*"
}
]
}
Source bucket policy:
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Statement1",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::<source account>:role/service-role/PutReplicationFunction-role-pugxea1r"
},
"Action": "s3:*",
"Resource": [
"arn:aws:s3:::<source bucket>",
"arn:aws:s3:::<source bucket>/*"
]
}
]
}
IAM pass role:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"iam:GetRole",
"iam:PassRole"
],
"Resource": "*"
}
]
}
Input request:
client.put_bucket_replication(
Bucket='<source bucket>',
ReplicationConfiguration={
'Role': '<iam role used for replication>',
'Rules': [
{
"Priority": 0,
"DeleteMarkerReplication": {"Status": "Disabled"},
"Filter": {"Prefix": ""},
'Status': 'Enabled',
'Destination': {
'Bucket': 'arn:aws:s3:::<destination bucket>'
}
}
]
}
)
Response:
{
"errorMessage": "An error occurred (AccessDenied) when calling the PutBucketReplication operation: Access Denied",
"errorType": "ClientError",
"requestId": "10515e45-992c-46bf-a20d-cce84c47dbb7",
"stackTrace": [
" File \"/var/task/lambda_function.py\", line 7, in lambda_handler\n response = client.put_bucket_replication(\n",
" File \"/var/runtime/botocore/client.py\", line 391, in _api_call\n return self._make_api_call(operation_name, kwargs)\n",
" File \"/var/runtime/botocore/client.py\", line 719, in _make_api_call\n raise error_class(parsed_response, operation_name)\n"
]
}
I also tried adding the bucket policy on destination account, but it is still not working
Destination bucket policy:
{
"Version": "2012-10-17",
"Id": "",
"Statement": [
{
"Sid": "Set permissions for objects",
"Effect": "Allow",
"Principal": {
"AWS": "<iam role used for replication>"
},
"Action": [
"s3:ReplicateObject",
"s3:ReplicateDelete"
],
"Resource": "arn:aws:s3:::<destination bucket>/*"
},
{
"Sid": "Set permissions on bucket",
"Effect": "Allow",
"Principal": {
"AWS": "<iam role used for replication>"
},
"Action": [
"s3:List*",
"s3:GetBucketVersioning",
"s3:PutBucketVersioning"
],
"Resource": "arn:aws:s3:::<destination bucket>"
}
]
}