A county DR runbook restores encrypted Amazon RDS snapshots into a second Region. What must the architect validate so recovery actually succeeds?
Select an answer to reveal the explanation.
Short Explanation
An encrypted snapshot is a locked suitcase—you need the matching key in the DR Region to open it. Multi-Region KMS keys or a planned key copy keep restore from stalling. Deleting the primary first or opening every SG does not unlock crypto.
Full Explanation
Restoring encrypted RDS resources depends on access to the KMS keys that protect the snapshots. DR designs must ensure keys are present and usable in the recovery Region, such as with multi-Region keys or controlled key material copy. Disabling CloudTrail, destroying the primary first, or opening security groups to the world do not address key availability for encrypted restore.