# KMS Key Permission Requirements for Amazon Redshift

To replicate encrypted Amazon Redshift snapshot copies, ensure that the following prerequisites are met:

- In the destination Region, create a KMS key with the alias `cvlt-redshift`. If you use a KMS key with a different alias, add a tag named `cvlt-redshift` to that KMS key.

- Add the IAM user as a key user for the KMS key used in the destination Region.

- The AWS account performing the snapshot copy must have the following permissions on the destination KMS key:

  - kms:CreateGrant

  - kms:Encrypt

  - kms:Decrypt

  - kms:ReEncrypt*

  - kms:GenerateDataKey*

  - kms:DescribeKey

×

Loading...