# Migrating Encrypted KMS Data Across Regions

* **Keys generated by KMS are only stored and used in the region in which they were created**.\\

* They **cannot be transferred to another region**.\\

* During migration, **services like EBS can change the CMK to the destination region**.\\

* If you have been **using envelope encryption** and have encrypted data with data-keys, then you will **have to decrypt all those data before migrating** to a different region.

* **Before, due to the limitation of KMS being region-specific, RDS used to only support the migration of unencrypted RDS snapshots** across regions but **now we can easily migrate even the encrypted RDS snapshots across regions**.

## Copying a RDS snapshot

* **If you delete a source snapshot before the target snapshot becomes available, the snapshot copy may fail**.\\

* If you **copy an encrypted snapshot, the copy of the snapshot must also be encrypted**.\\

* If you **copy an encrypted snapshot within the same Region, you can encrypt the copy with the same KMS CMK as the original snapshot**, or you can specify a different KMS CMK.\\

* If you **copy an encrypted snapshot across Regions, you can't use the same KMS CMK for the copy as used for the source snapshot**, because AWS KMS CMKs are Region-specific.

  * Instead, you **must specify a AWS KMS CMK valid in the destination Region**.

* You can also **encrypt a copy of an unencrypted snapshot**.
  * This way, you can quickly **add encryption to a previously unencrypted DB instance**.
    \*
    1. Create a **snapshot of your DB instance** when you are ready to encrypt it.
    2. Then, create a **copy of that snapshot** and **specify a KMS CMK to encrypt that snapshot copy**.
    3. **Restore an encrypted DB instance from the encrypted snapshot**.
