DynamoDB: can we use encryption and cross-region replication together?
<p>DynamoDB: can we use encryption and cross-region replication together?</p>

<p>We are evaluating DynamoDB for our new application. Our requirements are:</p>

<ul>
<li>Data encryption at rest</li>
<li>Cross-region replication for disaster recovery. Our app in a region must rely on services in that region only</li>
</ul>

<p>Our requirements can be met separately with using Java libraries provided by AWS. The solutions are:</p>

<ul>
<li><a href="https://github.com/awslabs/aws-dynamodb-encryption-java" rel="noreferrer">Client-side Encryption for Amazon DynamoDB</a></li>
<li><a href="https://github.com/awslabs/dynamodb-cross-region-library" rel="noreferrer">DynamoDB Cross-region Replication</a></li>
</ul>

<p>However, we are not certain if these solutions can work together. We are concern we won't be able to decrypt cross-region replicated records. The client side encryption solution recommends establishing a key hierarchy with a KMS-managed key at the root. KMS is region-specific, so we won't be able to decrypt records if we replicate them to another region. The encryption key is not accessible in another region.</p>

<p>The questions are:</p>

<ul>
<li>Is it true that the decryption or cross-region replicated records is impossible if the encryption key is in KMS?</li>
<li>Is there a recommended approach to replicating encrypted DynamoDB records? Has anyone done this before?</li>
<li>Are there any alternatives we should be looking at?</li>
</ul>