Tax archives need automated cross-Region backup copies encrypted with KMS keys usable in the destination Region. Which design is appropriate?
Select an answer to reveal the explanation.
Short Explanation
Shipping tax archives to another Region only works if the locksmith there has a key that opens the box. Automate the copy and use destination-usable KMS keys. Laptop mule runs, source-only keys, or plaintext copies fail the DR encryption test.
Full Explanation
Cross-Region backup strategies should be automated (for example AWS Backup cross-Region copy or snapshot copy workflows) so archives exist in the recovery Region without manual steps. Encryption must use KMS keys that can decrypt in the destination Region—commonly multi-Region KMS keys or CMKs created in that Region with appropriate grants. Source-only keys, manual laptop transfers, and unencrypted destination copies do not meet municipal encryption and recoverability requirements.