A company runs workloads only in the us-east-1 Region and now needs to replicate its workloads and infrastructure to the us-west-1 Region. A security engineer must implement AWS Secrets Manager to store secrets in both Regions, encrypted with AWS Key Management Service (AWS KMS). The solution must minimize latency and continue to work if only one Region is available. The secrets have been created in us-east-1. What should the security engineer do next?

The correct answer ensures high availability and low latency by replicating secrets and using multi-Region KMS keys. Multi-Region KMS keys allow the same logical key to exist in multiple Regions, enabling decryption in the local Region without cross-Region calls, thus minimizing latency and ensuring continued operation if one Region is unavailable. Replicating the secrets to us-west-1 makes them locally available. Encrypting with an AWS managed KMS key (first option) doesn't allow for multi-Region replication of the key itself, which is needed for seamless decryption across Regions. Configuring resources in us-west-1 to call the us-east-1 endpoint (second and third options) introduces cross-Region latency and a single point of failure, violating the requirement for low latency and continued operation if only one Region is available.