Back to Checks
aws

AWS KMS customer managed key is single-Region

kms_cmk_not_multi_region
Service: kmsSeverity: medium
OfficialBuilt-inVerified
Categories:encryption
Resource Type:AwsKmsKey

AWS KMS customer-managed keys in an Enabled state are assessed for the multi-Region setting. The finding highlights keys with the multi-Region property enabled.

Prowler logoProwlerprowler-provider-aws

Risk

Shared key material across Regions lets access in one Region decrypt data from another, eroding confidentiality and data residency. A misconfigured policy or weaker controls in a replica expand the blast radius. For signing/HMAC keys, compromise enables cross-Region signature forgery, impacting integrity and auditability.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks kms_cmk_not_multi_region

Recommendation

Prefer single-Region keys by default; use multi-Region only with a documented need. Apply least privilege and separation of duties; limit who can create or replicate such keys. Isolate per Region/tenant/workload, standardize policy and logging across Regions, and retire multi-Region keys where unnecessary.

Remediation

Terraform

# Terraform: create a single-Region KMS key
resource "aws_kms_key" "example" {
  multi_region = false  # Critical: creates a single-Region key to pass the check
}

NativeIaC

# CloudFormation: create a single-Region KMS key
Resources:
  ExampleKmsKey:
    Type: AWS::KMS::Key
    Properties:
      MultiRegion: false  # Critical: ensures the key is single-Region to pass the check
      KeyPolicy:          # Minimal policy required for key creation
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              AWS: !Sub arn:aws:iam::${AWS::AccountId}:root
            Action: 'kms:*'
            Resource: '*'

Other

1In the AWS Console, go to Key Management Service (KMS) > Customer managed keys
2Identify keys showing Multi-Region: Yes (these FAIL the check)
3Click Create key and ensure Multi-Region is not selected (single-Region)
4Update your services/aliases to use the new single-Region key
5Re-encrypt or rotate data to the new key where required
6After migration, disable the old multi-Region key and schedule its deletion

Check Code

from typing import List

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.kms.kms_client import kms_client


class kms_cmk_not_multi_region(Check):
    """kms_cmk_not_multi_region verifies if a KMS key is multi-regional"""

    def execute(self) -> List[Check_Report_AWS]:
        findings = []

        for key in kms_client.keys:
            if key.manager == "CUSTOMER" and key.state == "Enabled":
                report = Check_Report_AWS(metadata=self.metadata(), resource=key)
                report.status = "PASS"
                report.status_extended = f"KMS CMK {key.id} is a single-region key."

                if key.multi_region:
                    report.status = "FAIL"
                    report.status_extended = f"KMS CMK {key.id} is a multi-region key."

                findings.append(report)

        return findings

References