resource "aws_kms_external_key" "primary" {
  deletion_window_in_days = 30
  description = "Multi-Region primary key"
  enabled = true
  key_material_base64 = "..."
  multi_region = true
  provider = "aws.primary"
}

resource "aws_kms_replica_external_key" "replica" {
  deletion_window_in_days = 7
  description = "Multi-Region replica key"
  key_material_base64 = "..."
  primary_key_arn = "aws_kms_external.primary.arn"
}