A financial services firm needs to relocate its historical transaction archives from an on… — AWS Certified Solutions Architect - Professional

A financial services firm needs to relocate its historical transaction archives from an on-premises legacy POSIX storage array to Amazon S3. The archive consists of $750\text{ TB}$ of data. The target S3 bucket is hosted in the firm's production AWS account (Account A). The security policy requires that all archived data must be encrypted at rest using a customer managed key (CMK) hosted in a separate security governance AWS account (Account B). The migration must be completed within $25$ days. The firm has an active $1\text{ Gbps}$ AWS Direct Connect connection, but network utilization reports indicate that only $200\text{ Mbps}$ of bandwidth can be spared for this migration without impacting core trading operations. Which migration strategy should a solutions architect recommend to meet these requirements with the least operational overhead?

A
Deploy AWS DataSync agents on-premises to mount the POSIX storage array. Establish a private virtual interface over the Direct Connect connection to an AWS Transit Gateway, and run a DataSync task to transfer the data directly to the S3 bucket in Account A, specifying the customer managed key from Account B for target object encryption.
B
Deploy AWS DataSync agents on-premises connected to Account A. Configure a Direct Connect Gateway associated directly with the VPC containing the DataSync VPC endpoints, and configure Transit Gateway static routes to bypass the $200\text{ Mbps}$ limitation on the Direct Connect connection, allowing the DataSync task to transfer the data using the customer managed key from Account B.
Order multiple AWS Snowball Edge Storage Optimized devices in Account A, specifying the ARN of the customer managed key from Account B for encryption when creating the jobs. Configure Account B's key policy to allow Account A's IAM entities and the Snowball service principal to use the key. Copy the data to the devices on-premises, and ship them back to AWS to import the data into Account A's S3 bucket.Answer
D
Order multiple AWS Snowball Edge Storage Optimized devices in Account A, specifying the default AWS-managed KMS key (aws/s3) for transit encryption. Once the data is imported into the S3 bucket in Account A, run an Amazon S3 Batch Operations job to copy and re-encrypt the objects in-place using the customer managed key from Account B.

Answer

Ordering multiple AWS Snowball Edge Storage Optimized devices in Account A, specifying the ARN of the customer managed key from Account B, and configuring the key policy to allow cross-account access is the correct solution.

The correct strategy involves using AWS Snowball Edge devices to physically transfer the

750\text{ TB}

of data, which easily completes within the

25

-day window (typically taking a few days for copy and shipping). To satisfy the security requirement of encrypting the data with Account B's customer managed KMS key, the job must be created with the cross-account key ARN, and the key policy in Account B must be configured to permit the Snowball service principal and Account A's IAM identities to use the key.

Step-by-Step Solution

Calculate the network transfer time for the dataset over the available network bandwidth.

750\text{ TB}

of data transferred over a

200\text{ Mbps}

connection would take

\approx 347

days, which is far greater than the

25

-day migration window. Therefore, offline data transfer using AWS Snowball Edge is required.

Determines if an online or offline migration strategy is required based on bandwidth and time constraints.

Configure the KMS Customer Managed Key policy in Account B to allow cross-account usage.

Add the target AWS Account A's root ARN or specific IAM role, along with the Snowball service principal (`import.snowball.amazonaws.com`), to the key policy with actions such as `kms:DescribeKey`, `kms:CreateGrant`, `kms:Decrypt`, and `kms:GenerateDataKey*`.

Enables the Snowball service in Account A to use Account B's customer managed key for encryption during the import process.

Order AWS Snowball Edge Storage Optimized devices from Account A and copy the data.

Multiple devices are ordered, specifying the cross-account KMS key ARN. The data is copied from the on-premises storage to the devices using the Snowball client, and the devices are shipped back to AWS.

Executes the physical data transfer within the timeline and ensures data is encrypted at rest using the correct key.

Key Concept

Selecting between online and offline migration based on bandwidth and time constraints, and configuring cross-account KMS key policies for Snowball Edge imports.

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic