A workload spans two Regions and encrypts its database, block volumes, and object storage with one customer managed key. The same key identifier must work in both Regions so that replicated data can be decrypted locally. Which KMS feature is required?
Show answer and explanation
Answer: C
KMS multi-Region keys share the same key ID and key material across Regions, with a primary key and replica keys. Data encrypted in one Region can be decrypted in another without re-encrypting it, which suits cross-Region replication. Each replica has its own key policy and grants, so the replica in each Region must be governed explicitly.
Why the other options are wrong
- A. KMS key material cannot be exported from KMS for copying. Manually duplicating a symmetric key is not a supported approach, and it would break the single key identity the requirement depends on.
- B. AWS-managed keys are scoped to one Region and to the service that creates them. The team cannot control their key policy or use one key identity across Regional resources.
- D. Asymmetric KMS keys are used for signing and public-key encryption, not for the data-key envelope encryption these services rely on, so they cannot satisfy this storage requirement.