Set up AWS KMS multi-Region keys for cross-Region encryption and decryption

Steps

1. Create a multi-Region primary key in your primary AWS Region; note that the key material is the same across all related replicas
2. Replicate the primary key to one or more additional Regions using the KMS console or ReplicateKey API; each replica has a distinct ARN but shares key material
3. Update key policies on each replica independently; policies are not automatically synchronized across Regions
4. Encrypt data in one Region using the primary or a replica key, then decrypt in another Region using the local replica without sending ciphertext across Regions
5. Use multi-Region keys with DynamoDB global tables or cross-Region S3 replication where data must be readable in multiple Regions without cross-Region KMS calls
6. Monitor replication lag and key policy drift with CloudTrail events in each Region; set up alarms if a replica key becomes disabled