{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/choose-s3-delete-marker-replication-without-assuming-every-deletion-is-mirrored/", "item": { "id": "https://update.dsesecurity.com/updates/choose-s3-delete-marker-replication-without-assuming-every-deletion-is-mirrored/", "slug": "choose-s3-delete-marker-replication-without-assuming-every-deletion-is-mirrored", "url": "https://update.dsesecurity.com/updates/choose-s3-delete-marker-replication-without-assuming-every-deletion-is-mirrored/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/choose-s3-delete-marker-replication-without-assuming-every-deletion-is-mirrored.md", "json": "https://update.dsesecurity.com/api/v1/posts/choose-s3-delete-marker-replication-without-assuming-every-deletion-is-mirrored/" }, "title": "Choose S3 delete-marker replication without assuming every deletion is mirrored", "summary": "Make delete-marker propagation a deliberate part of the replica design.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "cyber-defense", "label": "Cyber defense", "alt": "Layered glass and metal cyber-defense structure with controlled blue and gold signal paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-10-20T18:13:28+00:00", "modified_at": "2026-10-20T18:34:28+00:00", "reviewed_on": "2026-10-20", "reading_minutes": 2, "word_count": 242, "potentially_affected": "This concerns delete markers in versioned S3 replication, rather than permanent deletion of a named object version.", "dse_recommendation": "DSE recommends deciding whether a destination should mirror ordinary source deletions or retain a visibly independent recovery view.", "primary_source": { "name": "AWS Documentation", "url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/delete-marker-replication.html", "published_on": null, "authority": "docs.aws.amazon.com" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Make delete-marker propagation a deliberate part of the replica design.

\n

Source facts

\n

S3 can replicate user-created delete markers when the feature is enabled in an eligible rule. Tag-based replication rules do not support delete-marker replication. Markers produced by Lifecycle expiration are not replicated by this feature, and AWS excludes delete-marker replication from the S3 Replication Time Control fifteen-minute SLA.

\n

Source: AWS Documentation.

\n

Applicability

\n

This concerns delete markers in versioned S3 replication, rather than permanent deletion of a named object version.

\n

DSE recommendation

\n

DSE recommends deciding whether a destination should mirror ordinary source deletions or retain a visibly independent recovery view. Record that decision with the rule filter and the retention owner. Avoid treating a marker as proof that all historical content has disappeared. Keep the operator instructions explicit about accessing older versions and about the difference between user deletion and Lifecycle cleanup. Review application behavior at both destinations before changing an existing replication rule. Write the destination-side recovery procedure before enabling propagation. Ask an operator to locate a retained test version after a marker appears and describe the result in business terms, so deletion visibility is not confused with the organization’s retention decision.

\n

Verification

\n

Proposed verification: create disposable objects, perform an ordinary source delete, and inspect markers and retained versions at the destination. Compare the result with an approved Lifecycle case separately. Record actual timing without representing the documented marker behavior as an SLA-backed replication deadline.

\n

Official reference

\n

AWS Documentation. Reviewed October 20, 2026.

", "content_text": "Make delete-marker propagation a deliberate part of the replica design.\nSource facts\nS3 can replicate user-created delete markers when the feature is enabled in an eligible rule. Tag-based replication rules do not support delete-marker replication. Markers produced by Lifecycle expiration are not replicated by this feature, and AWS excludes delete-marker replication from the S3 Replication Time Control fifteen-minute SLA.\nSource: AWS Documentation.\nApplicability\nThis concerns delete markers in versioned S3 replication, rather than permanent deletion of a named object version.\nDSE recommendation\nDSE recommends deciding whether a destination should mirror ordinary source deletions or retain a visibly independent recovery view. Record that decision with the rule filter and the retention owner. Avoid treating a marker as proof that all historical content has disappeared. Keep the operator instructions explicit about accessing older versions and about the difference between user deletion and Lifecycle cleanup. Review application behavior at both destinations before changing an existing replication rule. Write the destination-side recovery procedure before enabling propagation. Ask an operator to locate a retained test version after a marker appears and describe the result in business terms, so deletion visibility is not confused with the organization’s retention decision.\nVerification\nProposed verification: create disposable objects, perform an ordinary source delete, and inspect markers and retained versions at the destination. Compare the result with an approved Lifecycle case separately. Record actual timing without representing the documented marker behavior as an SLA-backed replication deadline.\nOfficial reference\nAWS Documentation. Reviewed October 20, 2026.", "content_markdown": "Make delete-marker propagation a deliberate part of the replica design.\n\n## Source facts\n\nS3 can replicate user-created delete markers when the feature is enabled in an eligible rule. Tag-based replication rules do not support delete-marker replication. Markers produced by Lifecycle expiration are not replicated by this feature, and AWS excludes delete-marker replication from the S3 Replication Time Control fifteen-minute SLA.\n\nSource: [AWS Documentation](https://docs.aws.amazon.com/AmazonS3/latest/userguide/delete-marker-replication.html).\n\n## Applicability\n\nThis concerns delete markers in versioned S3 replication, rather than permanent deletion of a named object version.\n\n## DSE recommendation\n\nDSE recommends deciding whether a destination should mirror ordinary source deletions or retain a visibly independent recovery view. Record that decision with the rule filter and the retention owner. Avoid treating a marker as proof that all historical content has disappeared. Keep the operator instructions explicit about accessing older versions and about the difference between user deletion and Lifecycle cleanup. Review application behavior at both destinations before changing an existing replication rule. Write the destination-side recovery procedure before enabling propagation. Ask an operator to locate a retained test version after a marker appears and describe the result in business terms, so deletion visibility is not confused with the organization’s retention decision.\n\n## Verification\n\nProposed verification: create disposable objects, perform an ordinary source delete, and inspect markers and retained versions at the destination. Compare the result with an approved Lifecycle case separately. Record actual timing without representing the documented marker behavior as an SLA-backed replication deadline.\n\n## Official reference\n\n[AWS Documentation](https://docs.aws.amazon.com/AmazonS3/latest/userguide/delete-marker-replication.html). Reviewed October 20, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/choose-s3-delete-marker-replication-without-assuming-every-deletion-is-mirrored/", "url": "https://update.dsesecurity.com/updates/choose-s3-delete-marker-replication-without-assuming-every-deletion-is-mirrored/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-20" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/choose-s3-delete-marker-replication-without-assuming-every-deletion-is-mirrored/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Cybersecurity", "item": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "ListItem", "position": 3, "name": "Choose S3 delete-marker replication without assuming every deletion is mirrored", "item": "https://update.dsesecurity.com/updates/choose-s3-delete-marker-replication-without-assuming-every-deletion-is-mirrored/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/choose-s3-delete-marker-replication-without-assuming-every-deletion-is-mirrored/#article", "identifier": "https://update.dsesecurity.com/updates/choose-s3-delete-marker-replication-without-assuming-every-deletion-is-mirrored/", "url": "https://update.dsesecurity.com/updates/choose-s3-delete-marker-replication-without-assuming-every-deletion-is-mirrored/", "headline": "Choose S3 delete-marker replication without assuming every deletion is mirrored", "description": "Make delete-marker propagation a deliberate part of the replica design.", "abstract": "Make delete-marker propagation a deliberate part of the replica design.", "articleBody": "Make delete-marker propagation a deliberate part of the replica design.\nSource facts\nS3 can replicate user-created delete markers when the feature is enabled in an eligible rule. Tag-based replication rules do not support delete-marker replication. Markers produced by Lifecycle expiration are not replicated by this feature, and AWS excludes delete-marker replication from the S3 Replication Time Control fifteen-minute SLA.\nSource: AWS Documentation.\nApplicability\nThis concerns delete markers in versioned S3 replication, rather than permanent deletion of a named object version.\nDSE recommendation\nDSE recommends deciding whether a destination should mirror ordinary source deletions or retain a visibly independent recovery view. Record that decision with the rule filter and the retention owner. Avoid treating a marker as proof that all historical content has disappeared. Keep the operator instructions explicit about accessing older versions and about the difference between user deletion and Lifecycle cleanup. Review application behavior at both destinations before changing an existing replication rule. Write the destination-side recovery procedure before enabling propagation. Ask an operator to locate a retained test version after a marker appears and describe the result in business terms, so deletion visibility is not confused with the organization’s retention decision.\nVerification\nProposed verification: create disposable objects, perform an ordinary source delete, and inspect markers and retained versions at the destination. Compare the result with an approved Lifecycle case separately. Record actual timing without representing the documented marker behavior as an SLA-backed replication deadline.\nOfficial reference\nAWS Documentation. Reviewed October 20, 2026.", "datePublished": "2026-10-20T18:13:28+00:00", "dateModified": "2026-10-20T18:34:28+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/choose-s3-delete-marker-replication-without-assuming-every-deletion-is-mirrored/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/choose-s3-delete-marker-replication-without-assuming-every-deletion-is-mirrored/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Choose S3 delete-marker replication without assuming every deletion is mirrored" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 242, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "AWS Documentation", "url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/delete-marker-replication.html" } } ] } }