Transfer customer managed SSE-KMS encrypted objects across AWS accounts and Regions using AWS DataSync

This article explains how to transfer server-side encrypted (SSE-KMS) objects across AWS accounts and Regions using AWS DataSync while maintaining control over the encryption keys. It covers the prerequisites and steps to configure DataSync, including creating IAM roles, updating KMS key policies, creating DataSync locations and tasks, and verifying the data transfer.

Specifically, the article covers:

• Solution overview and encryption options for S3 buckets
• Prerequisites for transferring SSE-KMS encrypted data
• Steps to create DataSync IAM roles and update KMS key policies
• Creating DataSync locations and tasks for the transfer
• Verifying the encrypted data transfer
• Cleaning up the resources after the proof of concept