KMS Multi-Regions
When WorkSpaces encryption uses customer-managed KMS keys, the same key must be available in both the primary and standby regions. AWS Multi-Region KMS Keys allow cryptographic key material to be replicated across regions while maintaining a relationship between the keys.
Prerequisites
Before creating a replica key, ensure that:
Use Custom KMS Keys are enabled in WorkSpaces Manager under Configuration > Settings > Amazon Web Services.
The source key is configured as a Multi-Region KMS Key
You have the required KMS administrative permissions
The key policy does not contain invalid principals
Create a Multi-Region KMS Key
If your existing KMS key is configured as a Single-Region Key, a new Multi-Region Key must be created.
Open the AWS KMS Console
Select Create Key
Choose the required Key Type and Key Usage
Expand Advanced Options
Select Multi-Region Key
Complete the remaining key configuration, including administrators, permissions, and key policy
Review the configuration and select Finish
Create a Replica Key
Once the Multi-Region Key has been created:
Open the primary KMS key
Under Regionality, select Create Replica Key
Select the standby region
Configure administrators, permissions, and key policy
Select Create Replica Key
Verify Replication
Open the primary KMS key and verify the standby region is listed under:
Regionality > Related multi-region keys
Replica keys should be created before enabling standby WorkSpaces in a new DR region.
Common Errors
MalformedPolicyDocumentException
This error is typically caused by invalid principals within the KMS key policy.
Example:
Common causes include:
Deleted IAM users
Deleted IAM roles
Invalid IAM principal identifiers
Legacy role identifiers (AROAxxxx)
Remove any invalid principals from the key policy before attempting replication again.
Single-Region Key
Multi-region replication cannot be enabled on an existing Single-Region Key. A new Multi-Region Key must be created instead.
Custom KMS Key Missing
If WorkSpaces Manager reports:
Verify that:
A replica key exists in the standby region
The replica key is enabled
WorkSpaces Manager is configured to use the correct KMS key in both regions
Last updated