> For the complete documentation index, see [llms.txt](https://docs.nuvens.cloud/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.nuvens.cloud/admin/appendices/kms-multi-regions.md).

# KMS Multi-Regions

When WorkSpaces encryption uses **customer-managed KMS keys**, the same key must be available in both the **primary** and **standby** regions. AWS **Multi-Region KMS Keys** allow cryptographic key material to be replicated across regions while maintaining a relationship between the keys.

#### Prerequisites

Before creating a replica key, ensure that:

* **Use Custom KMS Keys** are enabled in WorkSpaces Manager under **Configuration > Settings > Amazon Web Services**.
* The source key is configured as a **Multi-Region KMS Key**
* You have the required **KMS administrative permissions**
* The key policy does not contain invalid principals

#### Create a Multi-Region KMS Key

If your existing KMS key is configured as a **Single-Region Key**, a new Multi-Region Key must be created.

1. Open the **AWS KMS Console**
2. Select **Create Key**
3. Choose the required **Key Type** and **Key Usage**
4. Expand **Advanced Options**
5. Select **Multi-Region Key**<br>

   <figure><img src="/files/gVqJ1HoE03PWiuP0atkT" alt=""><figcaption></figcaption></figure>
6. Complete the remaining key configuration, including administrators, permissions, and key policy
7. Review the configuration and select **Finish**

#### Create a Replica Key

Once the Multi-Region Key has been created:

1. Open the primary KMS key
2. Under **Regionality**, select **Create Replica Key**
3. Select the standby region<br>

   <figure><img src="/files/FYTfnpS2REkZui6K4mcR" alt=""><figcaption></figcaption></figure>
4. Configure administrators, permissions, and key policy
5. Select **Create Replica Key**

#### Verify Replication

Open the primary KMS key and verify the standby region is listed under:

**Regionality > Related multi-region keys**

{% hint style="warning" icon="triangle-exclamation" %}
Replica keys should be created before enabling standby WorkSpaces in a new DR region.
{% endhint %}

#### Common Errors

**MalformedPolicyDocumentException**

This error is typically caused by invalid principals within the KMS key policy.

Example:

```
MalformedPolicyDocumentExceptionPolicy contains a statement with one or more invalid principals.
```

Common causes include:

* Deleted IAM users
* Deleted IAM roles
* Invalid IAM principal identifiers
* Legacy role identifiers (AROAxxxx)

Remove any invalid principals from the key policy before attempting replication again.

**Single-Region Key**

Multi-region replication cannot be enabled on an existing Single-Region Key. A new Multi-Region Key must be created instead.

**Custom KMS Key Missing**

If WorkSpaces Manager reports:

```
WorkSpace not created, custom KMS Key Missing
```

Verify that:

* A replica key exists in the standby region
* The replica key is enabled
* WorkSpaces Manager is configured to use the correct KMS key in both regions


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.nuvens.cloud/admin/appendices/kms-multi-regions.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.