Question

A media company stores original video assets in an S3 bucket in us-east-1, encrypted with a customer managed AWS KMS key. For disaster recovery, they must replicate all objects to a bucket in eu-west-1, and the replicated objects must remain encrypted at rest in the destination region. A compliance requirement states that KMS key material must never leave the region in which it was created. The solution must minimize operational overhead and avoid decryption failures in the destination region. Which approach meets these requirements?

Accepted Answer

Configure S3 Cross-Region Replication and specify a separate customer managed KMS key created in eu-west-1 for the destination objects, granting the replication IAM role permission to decrypt with the source key and encrypt with the destination key.

Answer

Configure S3 Cross-Region Replication using the same us-east-1 customer managed KMS key for both source and destination buckets, enabling multi-Region replication of key material.

Answer

Disable encryption on the source bucket, replicate the plaintext objects with Cross-Region Replication, then apply an S3 bucket policy in eu-west-1 that enforces default encryption with a local KMS key.

Answer

Use an AWS Lambda function triggered by S3 events to download each object, re-encrypt it with a eu-west-1 KMS key, and upload it to the destination bucket.