How Should Secrets Manager Secrets Be Encrypted and Replicated to us-west-1?
A company runs workloads in the us-east-1 Region. The company has never deployed resources to other AWS Regions and does not have any multi-Region resources. The company needs to replicate its workloads and infrastructure to the us-west-1 Region. A security engineer must implement a solution that uses AWS Secrets Manager to store secrets in both Regions. The solution must use AWS Key Management Service (AWS KMS) to encrypt the secrets. The solution must minimize latency and must be able to work if only one Region is available. The security engineer uses Secrets Manager to create the secrets in us-east-1. What should the security engineer do next to meet the requirements?
Community Insight
Tests whether you know Secrets Manager replicas are encrypted with a KMS key in the destination Region; the trap is assuming a standard us-east-1 customer managed key can encrypt a us-west-1 replica without being multi-Region.
Secrets Manager multi-Region replication with KMS encryption is the focus; this page establishes that replicating the secret and using a destination-Region KMS key in us-west-1 satisfies low latency and one-Region resilience.
The most common wrong answer is D: choosing a customer managed KMS key sounds more secure, but a standard regional CMK from us-east-1 cannot encrypt data in us-west-1 unless it is explicitly a multi-Region key.
Community Discussion (5 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Option A satisfies all constraints because it keeps secret access regional: Secrets Manager replication creates a us-west-1 replica, so us-west-1 workloads read locally and do not depend on us-east-1. Encrypting the source with the us-east-1 AWS managed KMS key and the replica with the us-west-1 AWS managed KMS key is valid because AWS managed keys are Regional and Secrets Manager supports a destination-Region key for replicas. This provides the required low latency and one-Region availability without needing a multi-Region customer managed key. The question does not require customer managed key policy control, so the simpler AWS managed key design is acceptable.Why the Other Options Are Wrong
Options B and C both send us-west-1 resources to the us-east-1 Secrets Manager endpoint, which adds cross-Region latency and fails the requirement to work if only one Region is available when us-east-1 is down. Option D looks stronger because it uses a customer managed key, but a normal customer managed KMS key is confined to its Region; a us-east-1 CMK cannot encrypt a us-west-1 secret replica unless it is a multi-Region key, and D never states that. If D had explicitly said multi-Region customer managed KMS key with a replica key in us-west-1, it could be a stronger security choice, but as written it is technically invalid. Option C also shares B's cross-Region endpoint flaw.Community Comment Notes
Strong23 raised the multi-Region KMS idea, noting that "setting the KMS key to be multi regional and replicating the secret should be enough"; that is true for a multi-Region customer managed key, but option D does not specify one. HarryNZ1982 preferred A while noting customer managed keys give "better control over Key Policy," which is a valid security preference but not a stated requirement here. Stpn2me highlighted that there will be "two different KMS encryptions" in us-east-1 and us-west-1, which matches A's destination-Region key design. gonzales explained that Secrets Manager replication supports "low-latency, regional access" and resilience, reinforcing why B and C's cross-Region endpoint approach is wrong.Official Reference
Exam Strategy
When a scenario demands low latency and availability if one Region fails, eliminate any option that uses a cross-Region Secrets Manager endpoint. Then verify the KMS key's Region: a standard CMK is regional, so the destination replica needs a destination-Region key, while only multi-Region keys share key material across Regions.
Frequently Asked Questions
Why can't option D use the us-east-1 customer managed KMS key for the us-west-1 replica?
A standard KMS customer managed key is Regional and cannot encrypt data in us-west-1. D only works if the key is explicitly multi-Region with a replica key in us-west-1.
Does Secrets Manager replication require a customer managed KMS key?
No. Secrets Manager can replicate secrets encrypted with the AWS managed aws/secretsmanager key, and the destination replica can use the destination Region's AWS managed key.
Related Analysis
Practice All SCS-C03 Questions
Access 86 questions with complete answers and detailed explanations.
View Full SCS-C03 Practice Test →