Why isn't my S3 Cross Region Replication working for some files? I've followed the documentation to set up cross-region replication to another AWS account.  It looked like it was working correctly until I noticed an entire prefix was missing.

Here is my destination bucket policy:

{
    "Version": "2008-10-17",
    "Id": "S3-Console-Replication-Policy",
    "Statement": [
        {
            "Sid": "S3ReplicationPolicyStmt1",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::&lt;awsaccount&gt;:root"
            },
            "Action": [
                "s3:GetBucketVersioning",
                "s3:PutBucketVersioning",
                "s3:ReplicateObject",
                "s3:ReplicateDelete",
                "s3:ObjectOwnerOverrideToBucketOwner"
            ],
            "Resource": [
                "arn:aws:s3:::bucket-backup",
                "arn:aws:s3:::bucket-backup/*"
            ]
        }
    ]
}


Looking further into it, I have also realized this particular prefix is where we store our public-access data, so maybe that's related somehow?
So I verified it was definitely public access causing the issue somehow; uploading an identical file but with the public read acl on totally broke it.

I worked with AWS support and they noticed I had "Block public access" enabled in the destination bucket.  Apparently rather than replicating the object and then making it private, it just fails replication.

tl;dr if you want to replicate objects that are public read, don't block public read at the destination.