KMS multi-region key should have replicas in DR regions

What it checks

KMS multi-region key should have replicas in DR regions

Where it applies

Terraform: aws_kms_key

CloudFormation: AWS::KMS::Key

How to fix it

1. Create aws_kms_replica_key resources in each DR region where you need to decrypt data. Use an aliased provider for the DR region.

Frameworks

• SOC 2 CC7.4
• NIST 800-53 rev5 SC-12

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules