# Choose S3 delete-marker replication without assuming every deletion is mirrored

> Make delete-marker propagation a deliberate part of the replica design.

- Canonical URL: https://update.dsesecurity.com/updates/choose-s3-delete-marker-replication-without-assuming-every-deletion-is-mirrored/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-10-20T18:13:28+00:00
- Modified: 2026-10-20T18:34:28+00:00
- Last reviewed by DSE: 2026-10-20
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, IT
- Reading time: 2 minutes

## What you need to know

Make delete-marker propagation a deliberate part of the replica design.

## Potentially affected

This concerns delete markers in versioned S3 replication, rather than permanent deletion of a named object version.

## DSE recommendation

DSE recommends deciding whether a destination should mirror ordinary source deletions or retain a visibly independent recovery view.

## Article

Make delete-marker propagation a deliberate part of the replica design.

## Source facts

S3 can replicate user-created delete markers when the feature is enabled in an eligible rule. Tag-based replication rules do not support delete-marker replication. Markers produced by Lifecycle expiration are not replicated by this feature, and AWS excludes delete-marker replication from the S3 Replication Time Control fifteen-minute SLA.

Source: [AWS Documentation](https://docs.aws.amazon.com/AmazonS3/latest/userguide/delete-marker-replication.html).

## Applicability

This concerns delete markers in versioned S3 replication, rather than permanent deletion of a named object version.

## DSE recommendation

DSE recommends deciding whether a destination should mirror ordinary source deletions or retain a visibly independent recovery view. Record that decision with the rule filter and the retention owner. Avoid treating a marker as proof that all historical content has disappeared. Keep the operator instructions explicit about accessing older versions and about the difference between user deletion and Lifecycle cleanup. Review application behavior at both destinations before changing an existing replication rule. Write the destination-side recovery procedure before enabling propagation. Ask an operator to locate a retained test version after a marker appears and describe the result in business terms, so deletion visibility is not confused with the organization’s retention decision.

## Verification

Proposed verification: create disposable objects, perform an ordinary source delete, and inspect markers and retained versions at the destination. Compare the result with an approved Lifecycle case separately. Record actual timing without representing the documented marker behavior as an SLA-backed replication deadline.

## Official reference

[AWS Documentation](https://docs.aws.amazon.com/AmazonS3/latest/userguide/delete-marker-replication.html). Reviewed October 20, 2026.

## Primary reference

- Name: AWS Documentation
- Authority: docs.aws.amazon.com
- URL: https://docs.aws.amazon.com/AmazonS3/latest/userguide/delete-marker-replication.html
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Choose S3 delete-marker replication without assuming every deletion is mirrored,” DSE Security, https://update.dsesecurity.com/updates/choose-s3-delete-marker-replication-without-assuming-every-deletion-is-mirrored/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.