Encrypted replication that doesn’t need cross-region role gymnastics.

The legacy setup decrypted in the source region, sent the plaintext to the destination region, and re-encrypted there. Both regions held distinct keys; the trust path was a cross-account IAM role with `kms:Decrypt` on the source side. Auditors had asked, reasonably, how we knew that path was secure.

KMS Multi-Region Keys hold the same key material in multiple regions without exposing the material to the customer. S3 replication can use the destination-region replica directly, eliminating the decrypt-and-re-encrypt round trip. We migrated three buckets representing the highest-sensitivity workloads first.

Cross-region trust paths went to zero. Replication latency was unchanged. The auditor’s questions resolved on a single architectural diagram. The migration ran transparently — existing encrypted objects could still be decrypted because we kept the legacy keys live during the transition window.