An enterprise needs to migrate 220\text{ TB} of legacy document archives from an on-premis… — AWS Certified Solutions Architect - Professional

An enterprise needs to migrate $220\text{ TB}$ of legacy document archives from an on-premises NFS file system to an Amazon S3 bucket. The enterprise has a $500\text{ Mbps}$ internet connection, but to avoid impacting business operations, they can allocate a maximum of $150\text{ Mbps}$ of bandwidth for the migration, and only during a $10\text{ hour}$ daily off-peak window. The migration must be completed within $25\text{ days}$ . Additionally, company compliance requires that the data be encrypted at rest using an AWS KMS key that is shared with a separate AWS audit account for security verification.

Which two actions should a solutions architect take to meet these requirements?

Order multiple AWS Snowball Edge Storage Optimized devices to copy the data locally and ship them to AWS for import into the Amazon S3 bucket.Answer
Create a KMS Customer Managed Key (CMK) in the target account, configure the key policy to grant the audit account decrypt permissions, and specify this key during the Snowball Edge job creation.Answer
C
Deploy AWS DataSync agents on-premises, configure a task to transfer data to the Amazon S3 bucket, and set a bandwidth limit of $150\text{ Mbps}$ during the off-peak window.
D
Order multiple AWS Snowball Edge Storage Optimized devices, specify the default AWS managed key (aws/s3) to encrypt the data, and add the audit account as a principal in the key policy.
E
Deploy an AWS Site-to-Site VPN connection, associate it with a Transit Gateway, and use AWS DataSync to copy the data over the VPN to the Amazon S3 bucket.

Answer

The correct migration plan is to order multiple AWS Snowball Edge Storage Optimized devices for physical transfer and configure a KMS Customer Managed Key (CMK) with cross-account permissions in its key policy.

The correct strategy uses multiple AWS Snowball Edge Storage Optimized devices because transferring

220\text{ TB}

of data over a

150\text{ Mbps}

connection for only

10\text{ hours}

per day would take more than

320\text{ days}

, which fails the

25\text{ days}

requirement. Additionally, a KMS Customer Managed Key (CMK) must be created to facilitate cross-account decryption permissions, as the key policy for the default AWS managed key cannot be updated to allow access to the audit account.

Step-by-Step Solution

Calculate the time required for a network-based migration:

220\text{ TB}

over

150\text{ Mbps}

for

10\text{ hours}

per day.

Daily transfer capability is

150\text{ Mbps} \times 36000\text{ seconds} = 5.4\text{ Terabits} \approx 675\text{ GB}

per day. Transferring

220\text{ TB}

would take approximately

326\text{ days}

To determine whether the online path (AWS DataSync) can meet the

25\text{ days}

requirement.

Evaluate the offline data transfer options based on the calculated timeline.

AWS Snowball Edge Storage Optimized devices must be used since shipping and importing the devices will take approximately

7

10\text{ days}

, well within the

25\text{ days}

limit.

To select the correct physical shipping mechanism for high-volume, time-constrained migration.

Address the cross-account KMS key sharing requirements.

Create a KMS Customer Managed Key (CMK) and grant decrypt access to the secondary audit account via key policy modifications.

AWS-managed keys (like aws/s3) cannot be shared cross-account as their key policies cannot be modified.

Key Concept

Selecting between AWS DataSync and Snowball Edge based on data size, available bandwidth, and transfer timeline, while utilizing Customer Managed Keys (CMKs) to satisfy cross-account key sharing compliance.

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic