A retailer encrypts S3 and EBS in us-east-1 and eu-west-1 with low-latency local decryption and centrally managed rotation, plus mutual TLS for internal services with private certificates. Which key and certificate management design should the security architect implement?
Select an answer to reveal the explanation.
Short Explanation
You're running bakeries on two coasts that need the same recipe, and that's your replica. Multi-Region KMS keys plus Private CA give you local speed with central control and fresh private certs.
Full Explanation
The correct design uses multi-Region customer managed KMS keys with replica keys because related keys share key material yet allow local low-latency cryptographic operations and coordinated rotation, paired with AWS Private CA to issue and renew private certificates for internal mTLS with centralized policy and revocation. Manually exporting single-Region key material to other Regions creates operational burden, risks exposure during transport, and breaks automatic replica synchronization and lifecycle management. ACM public certificates are trusted publicly but unsuitable for internal private PKI hierarchies, and independent single-Region keys force application logic to track per-Region key IDs without transparent failover. Storing data keys in Secrets Manager and using self-signed instance certificates bypasses KMS envelope encryption controls, audit trails, and CA revocation, weakening governance. For the exam, remember multi-Region keys replicate key material while replicas act locally, and Private CA handles private trust, and in practice verify key policies, replica permissions, and CA CRL distribution.