Question

A financial services company stores encrypted backups in Amazon S3 in us-east-1 using SSE-KMS with a customer managed key. For disaster recovery, they replicate these backups to a bucket in eu-west-1 using S3 Cross-Region Replication. The DR requirement states that in a regional outage of us-east-1, the eu-west-1 team must be able to decrypt the replicated objects without any dependency on us-east-1 resources. Which KMS approach meets this requirement with the least operational overhead?

Accepted Answer

Use a KMS multi-Region key, creating the primary key in us-east-1 and a replica key with the same key ID and material in eu-west-1, and configure replication to re-encrypt with the replica key.

Answer

Continue using the single us-east-1 customer managed key and grant the eu-west-1 team a cross-account grant so they can call Decrypt against the us-east-1 key.

Answer

Enable automatic annual key rotation on the us-east-1 key so that new key material is available in both Regions during the outage.

Answer

Import the same external key material into two independent single-Region KMS keys, one in each Region, and rotate the imported material manually every 90 days.