- [Instructor] Hello, everyone.
Today, I'll be showcasing a new feature
to AWS Key Management Service, Multi-Region keys.
AWS Key Management Service, or KMS,
now supports Multi-Region keys,
a new capability that lets you replicate keys
from one AWS region into another.
With Multi-Region keys,
you can more easily move encrypted data between regions
without having to decrypt and re-encrypt
with different keys in each region.
Multi-Region keys are supported
for client site encryption in the AWS Encryption SDK
AWS S3 encryption client,
and AWS DynamoDB encryption client.
They simplify any process
that copies protected data into multiple regions,
such as disaster recovery, backups,
or applications operating in multiple regions.
Later in the video, we will see an example
of using Multi-Region keys with DynamoDB global tables.
Let's walk through creating a Multi-Region key
and see one in action.
First, I'll demonstrate creating a multi-region KMS key
in the AWS console.
To get started, I'll select the AWS Key Management Service.
You can see I have some existing customer managed keys,
one is a symmetric regional key,
the other is a symmetric Multi-Region key.
You can see that it's a Multi-Region key
by the MRK in its key ID.
I'll click Create key, I'll choose Symmetric,
and I'll select Multi-Region key under the Advanced options.
I'll type a quick alias for this key.
For now we'll leave the administrative permissions default.
I'll click Finish to create the key.
And now you can see we have a KMS key
that is ready to be replicated to other regions.
Under Regionality, I can click Create new replica keys,
and then I can choose regions
for these new replica keys to be created.
For this demo, we'll click US East 1.
We can change these aliases
and description for the replica key,
but I'll leave these the same.
I'll also leave the permissions the same.
But these can be separate,
and you can select your own permissions
for the replica key in the other region.
You have to confirm
that you understand these values are not synchronized
with any of the other Multi-Region keys.
These are just replicas.
Okay, now we've successfully created that replica key
in US East 1.
Okay, so we've created a Multi-Region key
and replicated it to a new region,
but let's take a look
at how Multi-Region keys work in practice.
For this example, I've pre-created a Multi-Region key
and used it to encrypt a DynamoDB global table
that has a table in US East 2,
as well as a replica table in the US West 2 region.
This key is right here; its alias is DDB.
I'll select the DynamoDB service
and take a look at the table.
Here, under Additional settings,
you scroll down and find Encryption.
You can see it is encrypted with with a Multi-Region key,
again, indicated by the MRK in the key ID.
When I view items in the table,
I can see DynamoDB is transparently decrypting the table
and I can view the only item in the table,
the song "Purple Rain" by Prince.
Now let's change our region to US West 2,
and take a look at the KMS console.
Here you can see I have a replica key but it's disabled.
I did this to demonstrate what would happen
if this multi-region replica didn't exist.
Let's see what happens
when we navigate to the DynamoDB service
and attempt to view the items.
I'll click Explore Items to view the items in the table,
I'll select the music table,
and we can see have a KMS key disabled error.
DynamoDB is not able to use the disabled key
to decrypt the data and present it to me.
However, if I navigate back to the Key Management Service,
I'll, re-enable this key,
now we navigate back to DynamoDB
and we should be able to view the item
as DynamoDB can now use the key replica to decrypt the data.
Perfect.
Here we have Prince, "Purple Rain."
And that's it, we've created a Multi-Region key in KMS
and used it to encrypt and decrypt data
in two different regions.
Thanks for your time, and make sure
to consult the AWS Key Management Service documentation
for more information on Multi-Region keys.