Question

A company encrypts data in an S3 bucket in us-east-1 using a customer managed AWS KMS key. For disaster recovery, they replicate the objects to a bucket in eu-west-1 using S3 Cross-Region Replication. During a DR test, the CloudOps team finds that applications in eu-west-1 cannot decrypt the replicated objects, and the replication itself is failing on the KMS decrypt step. The team wants a solution that allows the same key material to be used for decryption in eu-west-1 without re-encrypting data or managing a separate key with different key material. What should they do?

Accepted Answer

Create a KMS multi-Region primary key in us-east-1 and a related multi-Region replica key in eu-west-1, then configure replication to encrypt destination objects with the replica key.

Answer

Enable automatic key rotation on the existing single-Region key so the rotated key material becomes available in eu-west-1.

Answer

Update the existing single-Region key policy in us-east-1 to grant decrypt permissions to the eu-west-1 applications and use the same key ARN in the destination Region.

Answer

Import the same external key material into a new single-Region KMS key created in eu-west-1 and point replication at that key.