An application uses AWS KMS to encrypt data before placing it into an Amazon S3 bucket in one AWS Region. Company policy requires data be encrypted prior to upload and decrypted by the application on read. The S3 bucket is replicated to other Regions. The application must be able to encrypt and decrypt the data across Regions and use the same key for decryption in every Region. Which solution meets these requirements?

A KMS multi-Region primary key and its replica keys allow you to encrypt data in one Region and decrypt it in another using the same key ID. This is crucial for cross-Region replication scenarios where data encrypted in a primary Region needs to be decrypted identically in replica Regions. The application can be updated to use the replica key in its respective Region, ensuring consistent decryption across all Regions. Creating separate customer-managed KMS keys in each Region would result in different key IDs, preventing decryption of data encrypted with a key from another Region. AWS Private Certificate Authority is for managing private certificates, not for encrypting and decrypting data directly. Exporting key material and storing it in Systems Manager Parameter Store is not recommended as it bypasses KMS's secure key management and introduces significant security risks.