AWS KMS customer managed key is single-Region

Check ID: kms_cmk_not_multi_region
Provider: AWS
Service: kms
Severity: MEDIUM
Categories: encryption
Resource type: AwsKmsKey

What this check verifies

AWS KMS customer-managed keys in an Enabled state are assessed for the multi-Region setting. The finding highlights keys with the multi-Region property enabled.

Risk

Shared key material across Regions lets access in one Region decrypt data from another, eroding confidentiality and data residency. A misconfigured policy or weaker controls in a replica expand the blast radius. For signing/HMAC keys, compromise enables cross-Region signature forgery, impacting integrity and auditability.

Recommendation

Prefer single-Region keys by default; use multi-Region only with a documented need. Apply least privilege and separation of duties; limit who can create or replicate such keys. Isolate per Region/tenant/workload, standardize policy and logging across Regions, and retire multi-Region keys where unnecessary.

Remediation

Terraform
Native IaC
Dashboard steps

# Terraform: create a single-Region KMS key
resource "aws_kms_key" "example" {
  multi_region = false  # Critical: creates a single-Region key to pass the check
}

# CloudFormation: create a single-Region KMS key
Resources:
  ExampleKmsKey:
    Type: AWS::KMS::Key
    Properties:
      MultiRegion: false  # Critical: ensures the key is single-Region to pass the check
      KeyPolicy:          # Minimal policy required for key creation
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              AWS: !Sub arn:aws:iam::${AWS::AccountId}:root
            Action: 'kms:*'
            Resource: '*'

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = kms_cmk_not_multi_region. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

AWS KMS customer managed key is not scheduled for deletion KMS customer-managed key has automatic rotation enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires