Question

A SysOps administrator manages an application that stores encrypted DynamoDB Global Table data in us-east-1 and eu-west-1. Client-side envelope encryption is used, and the same encrypted payloads must be decryptable in both Regions without making a cross-Region API call to a single KMS key. What is the MOST appropriate way to configure AWS KMS for this requirement?

Accepted Answer

Create a KMS multi-Region key in us-east-1 and replicate it to eu-west-1, then use the replica key in each Region for decryption

Answer

Create separate independent KMS keys in each Region and re-encrypt the data with the local key after replication

Answer

Create a single KMS key in us-east-1 and grant the eu-west-1 application cross-Region access via the key policy

Answer

Enable automatic key rotation on a single-Region KMS key so the rotated key material is available in both Regions