Question

A company runs an application in us-east-1 that encrypts customer records with an AWS KMS customer managed key. For disaster recovery, they replicate the encrypted data to an S3 bucket in eu-west-1 using S3 Cross-Region Replication. During a DR test, the application in eu-west-1 fails to decrypt the replicated objects. The security team confirms IAM permissions and the KMS key policy grant decrypt to the application role. What is the MOST appropriate solution to allow decryption in eu-west-1 while maintaining a single cryptographic key material?

Accepted Answer

Create a KMS multi-Region primary key in us-east-1 and a replica key in eu-west-1, then configure replication to re-encrypt objects with the replica key's ARN.

Answer

Enable automatic key rotation on the existing key so the rotated key material becomes available in eu-west-1.

Answer

Add a KMS grant on the us-east-1 key allowing the eu-west-1 application role to call Decrypt across Regions.

Answer

Configure S3 Bucket Keys on the destination bucket so the objects can be decrypted without a Region-specific KMS key.