Securing Multi-Region Architectures with KMS Multi-Region Keys

Act as an AWS Cryptography Expert. Develop an impenetrable, enterprise-grade security and encryption framework specifically engineered for a multi-region, active-active AWS environment. You must physically implement AWS KMS Multi-Region keys to allow for the seamless, instantaneous decryption of cross-region replicated data (e.g., DynamoDB global tables, S3 replication, or Aurora snapshots) without suffering the massive compute overhead of decrypting and re-encrypting payloads at the regional borders. Ensure the cryptographic strategy strictly aligns with the [ENCRYPTION_STANDARD] (e.g., AES-256-GCM) and the brutal regulatory requirements of the [COMPLIANCE_FRAMEWORK] (e.g., GDPR, FedRAMP). Detail the exact algorithmic [KEY_ROTATION_POLICY] (automated annual vs. manual on-demand) and provide the JSON IAM Key Policies required to enforce absolute least-privilege access for cross-region IAM roles attempting to execute `kms:Decrypt`.