An RDS database, an EBS snapshot and an S3 bucket must each be encrypted with the same KMS key, and that key must be usable in two Regions. Which key should be created?
Show answer and explanation
Answer: A
Multi-Region KMS keys are created as a primary in one Region and replicated to others while keeping the same key ID and key material. Ciphertext produced with one replica can be decrypted by another, so cross-Region encrypted resources work without re-encrypting the data.
Only customer managed keys can be configured as multi-Region keys.
Why the other options are wrong
- B. A single-Region key cannot decrypt its ciphertext in another Region, so data would have to be copied and re-encrypted.
- C. AWS managed keys such as aws/rds are created per service and per Region and cannot be shared or replicated.
- D. Imported key material is bound to the Region where it was imported and is not automatically usable elsewhere.