Question

A financial services company stores customer records on encrypted Amazon EBS volumes in the us-east-1 Region, using a customer managed AWS KMS key. To meet disaster recovery requirements, the company must maintain encrypted copies of these EBS snapshots in the eu-west-1 Region. During testing, engineers find that snapshots copied to eu-west-1 cannot be used to launch volumes. What is the MOST likely cause and correct solution?

Accepted Answer

KMS keys are Region-specific; the copy operation must re-encrypt the snapshot with a KMS key that exists in eu-west-1 by specifying a destination key during the CopySnapshot operation.

Answer

EBS snapshots cannot be encrypted with customer managed keys; convert the volumes to use the AWS managed aws/ebs key before copying.

Answer

The company must first decrypt the snapshots in us-east-1, copy them as unencrypted snapshots, then re-encrypt them after they arrive in eu-west-1.

Answer

KMS keys are global resources, so the failure is caused by a missing IAM permission; attach a policy granting kms:Decrypt on the source key and retry the copy.