A company has an encrypted Amazon Aurora DB cluster in the us-east-1 Region that uses an AWS KMS customer managed key. The company must copy a DB snapshot to the us-west-1 Region but cannot access…

Question

Options

• AStore the customer managed key in AWS Secrets Manager in us-west-1.
• BCreate a new customer managed key in us-west-1 and use it to encrypt the snapshot.
• CCreate an IAM policy to allow access to the key in us-east-1 from us-west-1.
• DCreate an IAM policy that allows RDS in us-west-1 to access the key in us-east-1.

• A
  2% (1)
• B
  84% (42)
• C
  10% (5)
• D
  4% (2)

Explanation

AWS KMS keys are strictly regional resources. According to AWS Certified Security - Specialty documentation, a KMS key created in one Region cannot be used to encrypt or decrypt data in another Region. This includes encrypted RDS and Aurora snapshots. When copying an encrypted snapshot to a different Region, the destination Region must have its own KMS key. AWS automatically re-encrypts the snapshot using the specified KMS key in the destination Region during the copy operation. Options C and D are invalid because IAM policies cannot extend a KMS key's scope across Regions. Option A is incorrect because Secrets Manager does not store or manage KMS keys AWS best practices require creating a new customer managed key in the target Region and using it during the snapshot copy process.

No community discussion yet for this question.