Question

A data engineering team stores encrypted datasets in an S3 bucket in us-east-1 using SSE-KMS with a customer managed key. To meet disaster recovery requirements, they configure S3 Cross-Region Replication to a destination bucket in eu-west-1. After enabling replication, they notice that objects encrypted with the customer managed key fail to replicate, while unencrypted objects replicate successfully. What must the team do to enable replication of the KMS-encrypted objects?

Accepted Answer

Enable replication of SSE-KMS encrypted objects in the replication configuration and specify a destination KMS key in eu-west-1, granting the replication IAM role permission to decrypt with the source key and encrypt with the destination key

Answer

Change the source bucket encryption to SSE-S3 because SSE-KMS encrypted objects cannot be replicated across Regions

Answer

Enable S3 Bucket Keys on the destination bucket, which automatically allows the replication role to reuse the source Region KMS key across Regions

Answer

Create a multi-Region KMS key and manually re-upload all objects, since replication does not support any form of KMS encryption