KMS multi-region key should restrict replica regions via key policy

What it checks

KMS multi-region key should restrict replica regions via key policy

Where it applies

Terraform: aws_kms_key

CloudFormation: AWS::KMS::Key

How to fix it

1. Add an explicit key policy with a Deny statement on kms:ReplicateKey for regions outside your approved list

Frameworks

• SOC 2 CC6.1
• NIST 800-53 rev5 SC-12

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules