Which solution will meet these requirements?
Create a KMS multi-Region primary key. Use the KMS multi-Region primary key to create a KMS multi-Region replica key in each additional Region where the application is running. Update the application code to use the specific replica key in each Region.
Create a new customer managed KMS key in each additional Region where the application is running. Update the application code to use the specific KMS key in each Region.
Use AWS Private Certificate Authority to create a new certificate authority (CA) in the primary Region. Issue a new private certificate from the CA for the application’s website URL. Share the CA with the additional Regions by using AWS Resource Access Manager (AWS RAM). Update the application code to use the shared CA certificates in each Region.
Use AWS Systems Manager Parameter Store to create a parameter in each additional Region where the application is running. Export the key material from the KMS key in the primary Region. Store the key material in the parameter in each Region. Update the application code to use the key data from the parameter in each Region.
Explanations:
A KMS multi-Region primary key allows the same key to be used across multiple AWS Regions, facilitating the encryption and decryption of data stored in S3. The application can leverage the multi-Region replica key created in each additional region to maintain consistency and security across the regions.
Creating a new customer managed KMS key in each additional region does not meet the requirement of using the same key for encryption and decryption across regions. Each key would be independent, making cross-region data access and decryption complex and insecure.
Using AWS Private Certificate Authority and issuing certificates does not relate to the use of KMS keys for data encryption and decryption. The application requires KMS for handling encryption keys, not certificate management, making this option irrelevant to the problem.
Exporting the key material from a KMS key and storing it in AWS Systems Manager Parameter Store is not recommended due to security concerns. KMS keys are not designed to have their material exported, and this would violate best practices for key management and security. Additionally, it does not fulfill the requirement of using the same key across regions effectively.
I weigh that the answer is:
Create a KMS multi-Region primary key. Use the KMS multi-Region primary key to create a KMS multi-Region replica key in each additional Region where the application is running. Update the application code to use the specific replica key in each Region.