A media streaming platform is designing a cross-region archive storage system for high-res… — AWS Certified Solutions Architect - Professional

A media streaming platform is designing a cross-region archive storage system for high-resolution video assets. The files contain proprietary digital media assets and must be stored in Amazon S3 buckets in two AWS Regions: $us-west-2$ (primary) and $eu-west-1$ (disaster recovery). The system architecture requires that files uploaded to $us-west-2$ are replicated to $eu-west-1$ using S3 Cross-Region Replication (CRR). The security policy requires:

- The media assets must be encrypted at rest using customer-managed KMS keys.
- In the event of a regional failover, applications in $eu-west-1$ must be able to decrypt the replicated data directly without performing any re-encryption or key management operations.
- The encryption keys must support automatic annual rotation.

Which combination of actions will meet these requirements? (Select TWO.)

Create a customer-managed multi-Region primary KMS key in the $us-west-2$ Region, and enable automatic key rotation on it.Answer
Create a multi-Region replica key in the $eu-west-1$ Region using the ARN of the primary key in the $us-west-2$ Region.Answer
C
Enable S3 Cross-Region Replication using the default AWS-managed KMS key for S3 ( $aws/s3$ ) in both the source and destination buckets.
D
Create independent, single-Region customer-managed KMS keys in both $us-west-2$ and $eu-west-1$ , and apply an AWS Organizations Service Control Policy (SCP) to authorize cross-region decryption.
E
Configure the S3 bucket policy in the $eu-west-1$ bucket to explicitly grant decryption permissions for the source KMS key in $us-west-2$ to the destination application's IAM role.

Answer

The correct combination of actions is to create a customer-managed multi-Region primary KMS key in the primary region (

us-west-2

) with automatic rotation enabled, and create a corresponding multi-Region replica key in the disaster recovery region (

eu-west-1

) using the primary key's Amazon Resource Name (ARN).

The correct approach involves using AWS KMS multi-Region keys. By creating a customer-managed primary multi-Region key in the source region and enabling automatic key rotation, AWS manages the rotation of key material. Creating a replica key in the destination region using the primary key's ARN ensures both keys share the same key ID and key material. When S3 replicates the encrypted objects, the application in the destination region can decrypt them directly using the local replica key without needing to re-encrypt the data or make cross-region KMS API calls.

Step-by-Step Solution

Deploy the primary key in the source Region.

A customer-managed KMS key is created as a multi-Region primary key in

us-west-2

This establishes the master key that controls the key material and rotation configuration.

Configure rotation on the primary key.

Automatic annual key rotation is enabled on the primary key in

us-west-2

Enabling rotation on the primary key automatically rotates the key material and propagates the new material to all linked replica keys.

Create the replica key in the destination Region.

A replica KMS key is created in

eu-west-1

referencing the primary key's ARN.

This guarantees that the destination key has the exact same key ID and key material as the primary key, enabling seamless decryption of replicated objects.

Key Concept

AWS KMS Multi-Region Keys

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic