The destination bucket is in the development account, so the destination encryption key should also be in the development account. A customer managed KMS key is required because its key policy can be edited to allow the production account to use it for encryption during the copy operation. AWS managed keys cannot have their key policies modified to grant cross-account access in the same way. Replicating or copying a KMS key from production is not the correct model for this requirement; KMS keys are regional resources and access is controlled through key policies and IAM permissions. The best design is therefore a new customer managed key in the development account with a key policy that permits the production account to use the key for the copy.

===============