How does KMS encrypted data behave with S3 Replication?
SSE‑KMS objects do not replicate automatically—you must explicitly enable KMS replication and provide decrypt/encrypt permissions and a destination KMS key, after which S3 decrypts with the source key and re‑encrypts replicas with the destination key.
