Cross account DMS-replication from DocumentDB to S3 - amazon-web-services

Question

I want to export data from DocumentDB compatible with MongoDB as source in account A to S3 as target in Account B in AWS.
Can I achieve this by vpc peering and what else do I have to do for cross account DMS from DocumentDB to S3

Answer 1

That kind of depends on where your replication instance lives.
If you place the replication instance in the same VPC as the DocumentDB, you won't even need VPC Peering.
Just set up the security groups to allow the replication instance to reach your DocumentDB and set it up as a Source Endpoint.
Assuming the replication instance has internet access or you've configured an S3 VPC endpoint, you can set up the S3-Bucket as a target. The role you configure when setting up the target, needs to have access to the S3 bucket.
Sample policy you can attach to the target role from the documentation:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"s3:PutObject",
"s3:DeleteObject",
"s3:PutObjectTagging"
],
"Resource": [
"arn:aws:s3:::buckettest2/*"
]
},
{
"Effect": "Allow",
"Action": [
"s3:ListBucket"
],
"Resource": [
"arn:aws:s3:::buckettest2"
]
}
]
}
The bucket in the target account needs to have a bucket policy that allows the same actions from the role in the source account. The policy will be almost identical, except that you also need to add the principal.