Cross-Region Key Management
While having the ability to create and manage KMS keys on a one-by-one basis is a useful feature to have, either through the AWS Management Console or programmatically from the CLI, once your accounts start to spread out geographically, keeping track of which keys encrypt items in which regions can become burdensome. Luckily, AWS has listened to customer feedback and has introduced functionality in KMS that allows users like yourself to replicate a KMS key from one region to another.
There are some best practices that you should be aware of when starting to manage your KMS keys across multiple regions:
- Turn on the KMS multi-Region replication: KMS provides the option to enable multi-region replication for customer master keys. By enabling this feature, KMS automatically replicates your CMKs to other regions, allowing you to use the same CMK for encryption and decryption in different regions.
- Choose a primary Region for creating and managing...
