An enterprise needs to migrate 1.2\text{ PB} of historical log data from an on-premises Ha… — AWS Certified Solutions Architect - Professional

An enterprise needs to migrate $1.2\text{ PB}$ of historical log data from an on-premises Hadoop Distributed File System (HDFS) cluster to Amazon S3. The company has a $1\text{ Gbps}$ AWS Direct Connect connection, but corporate policy restricts the migration workload to utilizing a maximum of $300\text{ Mbps}$ of this bandwidth. The migration must be completed within $45\text{ days}$ . Concurrently, legacy applications must continue writing new log data using the SFTP protocol. The target S3 bucket resides in a centralized Logging Account (Account B), and all stored logs must be encrypted at rest using a Customer Managed Key (CMK) in AWS Key Management Service (AWS KMS) managed by Account B. The migration is being executed by a team operating within a separate Migration Account (Account A), which is responsible for ordering and managing the transfer infrastructure. Which two options should the Solutions Architect recommend to satisfy these requirements? (Select TWO.)

Order 15 AWS Snowball Edge Storage Optimized devices from Account A, load the historical HDFS data onto the devices, and ship them to AWS to import the data into a temporary S3 bucket in Account A. Run an AWS DataSync task to copy the imported data from Account A's S3 bucket to Account B's S3 bucket, using Account B's Customer Managed Key (CMK) for encryption.Answer
B
Deploy an AWS DataSync agent on-premises and configure an HDFS source location. Create a DataSync task to transfer the $1.2\text{ PB}$ of historical data directly over the AWS Direct Connect connection to Account B's S3 bucket, setting a bandwidth limit of $300\text{ Mbps}$ on the task.
Set up an AWS Transfer Family SFTP-enabled server in Account B, configured with a public VPC endpoint. Map the server's user directories to Account B's S3 bucket, and configure the legacy applications to write new log data using this endpoint, authorizing access via an IAM role that encrypts objects using Account B's Customer Managed Key (CMK).Answer
D
Order 15 AWS Snowball Edge Storage Optimized devices from Account A. Configure the Snowball jobs to import the HDFS data directly into Account B's S3 bucket, specifying the default AWS-managed KMS key 'aws/s3' in Account B for target object encryption.
E
Configure an AWS Transfer Family SFTP server in Account A. Establish a transit routing path using AWS Transit Gateway and VPC peering to allow legacy applications to stream new data through Account A's SFTP server directly into Account B's S3 bucket, encrypting the objects using an AWS-managed KMS key.

Answer

Order AWS Snowball Edge Storage Optimized devices in the Migration Account (Account A) to migrate the historical HDFS data to a temporary S3 bucket in Account A, and then use AWS DataSync to copy that data to Account B's S3 bucket using Account B's Customer Managed Key. For the ongoing legacy SFTP traffic, deploy an AWS Transfer Family SFTP-enabled server in Account B mapping directly to the target S3 bucket and utilizing Account B's Customer Managed Key.

The correct architecture separates the bulk historical migration from the real-time legacy application logs. Because transferring

1.2\text{ PB}

over

300\text{ Mbps}

takes about

370

days, the Solutions Architect must use an offline migration option (AWS Snowball Edge Storage Optimized devices). Since the migration team operates in Account A, the

15

required devices must be ordered in Account A and imported into a temporary S3 bucket in Account A first, as cross-account direct target bucket selection is not supported in the Snowball Edge console. From there, AWS DataSync copies the data into Account B's S3 bucket, leveraging a Customer Managed Key (CMK) in Account B. This KMS key choice is mandatory because default AWS-managed KMS keys ('aws/s3') do not support policy modification and cannot be shared cross-account. To accommodate the legacy application SFTP requirement, establishing an AWS Transfer Family SFTP endpoint directly in Account B ensures that ongoing files write directly into the target bucket under the correct CMK encryption role.

Step-by-Step Solution

Calculate the transfer duration for the historical data over the network.

Total bits to transfer:

1.2\text{ PB} = 1.2 \times 10^{15}\text{ bytes} \times 8 = 9.6 \times 10^{15}\text{ bits}

. At a bandwidth limit of

300\text{ Mbps}

(

3 \times 10^8\text{ bits/second}

), the transfer time is:

\text{Time} = \frac{9.6 \times 10^{15}}{3 \times 10^8} = 3.2 \times 10^7\text{ seconds} \approx 370.37\text{ days}

This far exceeds the required

45

-day migration window.

Identify if physical shipment (Snowball Edge) or online transfer (DataSync) is required for the bulk historical data migration.

Determine Snowball Edge device sizing and cross-account constraint logic.

A single Snowball Edge Storage Optimized device has

80\text{ TB}

usable capacity. The number of devices required is:

\frac{1,200\text{ TB}}{80\text{ TB/device}} = 15\text{ devices}

Because Snowball Edge jobs must target a bucket in the same account as the order, the devices must be imported into a temporary bucket in Account A, and then transferred to Account B.

Comply with procurement rules where Account A manages the migration while honoring the technical constraint that Snowball imports are account-bound.

Select the cross-account encryption and copy tool.

AWS DataSync is selected to perform the copy from Account A's temporary bucket to Account B's bucket. Since the target encryption must use a Customer Managed Key (CMK) in Account B, the CMK's key policy must explicitly allow the DataSync execution role in Account A to use it. Default AWS-managed KMS keys ('aws/s3') cannot be used for this cross-account step.

Ensure security compliance by designing a secure, cross-account file copy mechanism that respects KMS CMK access controls.

Establish the SFTP channel for legacy writes.

Deploy an AWS Transfer Family SFTP endpoint directly in Account B to map user directories to the destination S3 bucket. Applications authenticate and write directly, encrypting objects via Account B's Customer Managed Key.

Satisfy the real-time application write protocol (SFTP) using native AWS services without introducing transitive network routing overhead.

Key Concept

Determining offline vs. online migration strategies based on network bandwidth/duration constraints, and addressing cross-account KMS key and bucket access limitations.

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic