A company operates all workloads in the us-east-1 Region and has no multi-Region resources. The company must replicate its workloads and infrastructure to us-west-1. A security engineer needs to store secrets in both Regions with AWS Secrets Manager, encrypted by AWS Key Management Service (AWS KMS), with minimal latency and the ability to operate if only one Region is available. The engineer has created the secrets in us-east-1. What should the engineer do next?

The correct option uses a multi-Region customer managed KMS key (CMK) to encrypt secrets in both regions. This allows the secrets to be replicated and decrypted independently in each region, ensuring minimal latency and operational capability even if one region is unavailable. Multi-Region CMKs are designed for this exact scenario, providing identical key material across specified regions. The first incorrect option suggests using AWS managed KMS keys and then new AWS managed KMS keys for the replicas. While this provides regional encryption, AWS managed keys cannot be replicated or shared across regions in the same way as multi-Region CMKs, making cross-region decryption of replicated secrets problematic without additional configuration. The second and third incorrect options both suggest configuring resources in us-west-1 to call the Secrets Manager endpoint in us-east-1. This introduces cross-region dependency and latency, directly violating the requirement for minimal latency and the ability to operate if only one region is available. If us-east-1 becomes unavailable, us-west-1 would lose access to the secrets.