A bank must encrypt Aurora data in us-east-1 and eu-west-1 under centralized control, allow independent regional decryption during an outage, and issue private mTLS certificates for microservices. Auditors require customer-managed key material. Which key and certificate plan should the security architect select to meet multi-Region resilience?
Select an answer to reveal the explanation.
Short Explanation
Outages don't wait for cross-Region key calls to succeed. Multi-Region keys keep identical material close to your data, so you can decrypt independently in either Region.
Full Explanation
A multi-Region KMS primary key with replicas shares key material under centralized control while allowing each Region to encrypt and decrypt independently during an isolated outage, supporting resilient Aurora encryption in us-east-1 and eu-west-1. AWS Private CA provides an internal trust hierarchy for microservices mTLS, with controlled certificate issuance, renewal, and revocation. Internet-trusted service certificates from ACM provide public validation for external clients rather than the private hierarchy needed for internal services and enterprise lifecycle controls. A centralized single-Region KMS key concentrates decryption availability and policy enforcement in one Region, so an outage or KMS impairment there can prevent decryption in the peer Region, even with private certificates. Multi-Region aws/rds keys do not meet the auditors’ requirement for customer-managed key material and key-policy lifecycle, even though they provide multi-Region protection and use Private CA. Exam caveat: distinguish replicated multi-Region keys from matching aliases in two Regions; only replicated keys enable independent regional decryption without cross-Region calls. Practical check: verify primary and replica key ARNs, Aurora encryption settings in both Regions, the Private CA hierarchy and CRL or OCSP distribution, and CloudTrail and IAM evidence of customer-managed key administration before production approval.