Exam AWS Certified Security - Specialty topic 1 question 487 discussion

"If you copy an encrypted snapshot across Regions, you must specify a KMS key valid in the destination AWS Region. It can be a Region-specific KMS key, or a multi-Region key." https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/aurora-copy-snapshot.html#aurora-copy-snapshot.Encryption

Option C & D: --> why they are wrong AWS KMS keys are regional resources and cannot be accessed directly from another region. which we are trying to do in step C and D. However, AWS KMS does support multi-region keys [which we are not using here but to explain]. Each set of related multi-Region keys has the same key material and key ID, so you can encrypt data in one AWS Region and decrypt it in a different AWS Region without re-encrypting or making a cross-Region call to AWS KMS.

https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/aurora-copy-snapshot.html#aurora-copy-snapshot.Encryption Handling encryption You can copy a snapshot that has been encrypted using a KMS key. If you copy an encrypted snapshot, the copy of the snapshot must also be encrypted. If you copy an encrypted snapshot within the same AWS Region, you can encrypt the copy with the same KMS key as the original snapshot. Or you can specify a different KMS key. If you copy an encrypted snapshot across Regions, you must specify a KMS key valid in the destination AWS Region. It can be a Region-specific KMS key, or a multi-Region key. For more information on multi-Region KMS keys, see Using multi-Region keys in AWS KMS.

To set up the snapshot in us-west-1 with proper encryption, you should create a new customer managed key in the us-west-1 Region. Then, use this new key to encrypt the snapshot when copying it to the us-west-1 Region. This ensures that the snapshot remains encrypted while also allowing you to comply with the necessary encryption requirements in the target Region.

Encryption with a customer managed key: The original Amazon Aurora DB cluster in the us-east-1 Region is encrypted with a customer managed key. This ensures that the data is protected and meets compliance requirements. Inaccessible key: The company cannot access the key used to encrypt the original database in us-west-1. This means that using the same key for encryption in the us-west-1 Region is not possible. Create a new customer managed key in us-west-1: To ensure proper encryption of the snapshot in the us-west-1 Region, the company should create a new customer managed key specifically for this region. This new key will be used to encrypt the snapshot, providing the necessary encryption and compliance requirements.