An enterprise needs to migrate an 850\text{ TB} dataset from an on-premises NFSv4 file sys… — AWS Certified Solutions Architect - Professional

An enterprise needs to migrate an $850\text{ TB}$ dataset from an on-premises NFSv4 file system to an Amazon EFS file system. The migration must be completed within a strict $45\text{-day}$ window. The enterprise has a dedicated $1\text{ Gbps}$ AWS Direct Connect connection, but local network policy restricts migration traffic to a maximum of $250\text{ Mbps}$ to avoid impacting production workloads. The data must be encrypted at rest in AWS using a KMS key that supports annual rotation and custom policy modifications. The migration process must preserve all POSIX permissions, ownership metadata, and directory structures. Which of the following solutions meets these requirements with the least operational overhead?

A
Deploy AWS DataSync agents on-premises. Establish a connection to the AWS environment using the existing $1\text{ Gbps}$ AWS Direct Connect connection. Create a Direct Connect gateway and configure transitive routing to connect the on-premises DataSync agents directly to the Amazon EFS mount target in the private subnet. Start a DataSync task with a bandwidth limit of $250\text{ Mbps}$ to copy the data directly from the on-premises NFS share to Amazon EFS.
B
Order multiple AWS Snowball Edge Storage Optimized devices. Configure the devices with the NFS interface and copy the data from the on-premises NFS share. Specify the AWS-managed KMS key (`aws/s3`) to secure the data on the devices. Ship the devices to AWS to import the data into an Amazon S3 bucket. Deploy an AWS DataSync agent on a virtual machine in the target VPC, and configure a DataSync task to copy the data from the S3 bucket to the Amazon EFS file system.
Order multiple AWS Snowball Edge Storage Optimized devices. Configure the devices with the NFS interface, mount them on-premises, and copy the files from the NFS share to the devices while specifying a KMS Customer Managed Key (CMK) for encryption. Ship the devices back to AWS to import the data into an Amazon S3 bucket. Create an AWS DataSync task without deploying any agents, selecting the S3 bucket as the source and the Amazon EFS file system as the destination, to copy the files while preserving POSIX permissions and metadata.Answer
D
Deploy AWS DataSync agents on-premises and configure a direct DataSync task to transfer data from the on-premises NFS share to the Amazon EFS file system over the $1\text{ Gbps}$ Direct Connect connection. Set the task bandwidth limit to $250\text{ Mbps}$ to comply with the network policy, and schedule it to run continuously until completion.

Answer

The solution that orders AWS Snowball Edge Storage Optimized devices, encrypts them using a Customer Managed Key (CMK), imports the data to Amazon S3, and then uses an agentless AWS DataSync task to copy the files to Amazon EFS.

The correct answer provides a dual-phase approach where the bulk offline transfer of

850\text{ TB}

is executed via multiple AWS Snowball Edge Storage Optimized devices, preventing network saturation. By utilizing a Customer Managed Key (CMK), the enterprise can successfully modify the key policy to delegate decrypt and encrypt permissions to the Snowball service principal. Finally, because both the S3 staging bucket and the destination EFS are within AWS, an agentless AWS DataSync task can be used, minimizing operational overhead while keeping POSIX permissions intact during the final migration phase.

Step-by-Step Solution

Calculate the transfer duration over the available network bandwidth.

Transferring

850\text{ TB}

250\text{ Mbps}

requires:

\frac{850 \times 10^{12} \text{ bytes} \times 8 \text{ bits/byte}}{250 \times 10^6 \text{ bits/second}} \approx 2.72 \times 10^7 \text{ seconds} \approx 315 \text{ days}

. This exceeds the

45\text{-day}

limit, meaning offline data transfer using AWS Snowball Edge is mandatory.

Determines whether an online transfer is mathematically feasible within the customer's timeline.

Verify KMS encryption compatibility for Snowball Edge.

AWS Snowball Edge requires custom permissions to be granted via a key policy to access the KMS key. AWS-managed KMS keys (like `aws/s3`) cannot be configured with custom key policies, so a Customer Managed Key (CMK) must be selected.

Ensures the encryption meets the compliance constraint and is technically compatible with Snowball Edge.

Select the correct protocol interface and verify metadata preservation.

Configure Snowball Edge with the NFS interface to copy files from the on-premises NFS share. This preserves POSIX permissions, ownership, and metadata by saving them as S3 user-defined metadata when imported.

Meets the requirement to preserve source file system permissions and structure.

Design the post-import transfer to the target file system.

Create an AWS DataSync task with Amazon S3 as the source and Amazon EFS as the destination. Because this is an AWS-to-AWS transfer, no DataSync agent needs to be deployed. DataSync reads the metadata stored in S3 and reconstructs the POSIX permissions on EFS.

Allows the transfer of data from the S3 landing zone to the final EFS target with minimum operational overhead and full metadata preservation.

Key Concept

Large-Scale Data Transfer using Snow Family, DataSync, and EFS

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic