Migrating AWS KMS Customer Keys to EU Central Region

Answer: D.

AWS KMS supports multi-region keys, which are AWS KMS keys in different AWS Regions that can be used interchangeably - as though you had the same key in multiple Regions.

With multi-Region keys, you can more easily move encrypted data between Regions without having to decrypt and re-encrypt with different keys in each Region.

Multi-Region keys are not global.

You create a multi-Region primary key and then replicate it into Regions that you select within an AWS partition.

Then you manage the multi-Region key in each Region independently.

Neither AWS nor AWS KMS ever automatically creates or replicates multi-Region keys into any Region on your behalf.

Option A is incorrect because neither AWS nor AWS KMS automatically replicates any keys into another Region.

Option B is incorrect because key rotation cannot be used to export keys.

Option C is incorrect because the backing key cannot be used to export keys.

Option D is CORRECT because multi-Region keys have the capability to replicate keys from one AWS Region into another.

For more information on KMS keys, kindly refer to the following URL:

https://aws.amazon.com/about-aws/whats-new/2021/06/kms-multi-region-keys/ https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html

Option A is not entirely accurate because while AWS KMS does automatically replicate keys to multiple regions, it is not guaranteed to happen immediately and might not always be desirable.

Option B involves key rotation, which is a process of creating a new key while the old key is still in use. This method can work, but it might be inefficient since it requires creating a new key for each region where you want to use the key.

Option C is not a recommended practice since it can introduce security risks. The backing key should always be kept secret and not shared between different regions.

Option D, using multi-Region keys in AWS KMS, is the recommended solution. Multi-Region keys allow you to create a single key that can be used across multiple regions. This key is backed by a set of regional keys that are created and managed by AWS KMS automatically. The regional keys are used to perform cryptographic operations within their respective regions, while the multi-Region key is used to manage the key material and metadata for the key. This approach provides a secure and efficient way to use a single key across multiple regions.