Use KMS multi-region keys for the default key

[nozaq]

Use KMS Multi-Region Keys to centralize the CMK creation, which is currently distributed among regions.

• Replace single-region keys with the multi-region key.
• Use the multi-region key for..
  • CloudTrail encryption
  • SNS topic encryption
• Optionally supporting single-region keys could be helpful, but the design depends on the upstream implementation.

Current status
Waiting for the multi-region keys to be supported in terraform-aws-provider(See this issue).

Ref: #182 #216

[giovannifl]

Any update ?

[nozaq]

@giovannifl We need to wait the AWS provider to support multi region key resource, but it seems the upstream issue is not resolved yet.

[willfarrell]

Now supported in terraform (https://github.com/hashicorp/terraform-provider-aws/releases/tag/v3.64.0)
https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kms_replica_key

[nozaq]

AWS suggests to use multi-region keys only if there is clear benefit since they introduce additional security concerns(ref).
Need to investigate more before deciding to use multi-region keys instead of having a single-region key for each region.

[nozaq]

After considering tradeoffs, I didn't find clear benefit over complications.
Closing it for now.