An organization needs to migrate of data from an on-premises Network File System (NFS) share to Amazon S3 within a strict 10-day window. The organization has a internet connection, of which only can be dedicated to this data transfer to avoid impacting production traffic. The data must be encrypted at rest using an AWS KMS Customer Managed Key (CMK) to comply with internal security policies. Which of the following is the most efficient and compliant method to complete this transfer?
- ADeploy AWS DataSync agents on-premises to sync the data directly to the Amazon S3 bucket over the network, using the customer managed KMS key for encrypting the data at rest.
- BOrder multiple AWS Snowball Edge Storage Optimized devices to copy the data offline, selecting the default AWS managed KMS key (`aws/s3`) to encrypt the data during the job creation.
- Order multiple AWS Snowball Edge Storage Optimized devices to copy the data offline, selecting a customer managed KMS key (CMK) to encrypt the data during the job creation.Answer
- DDeploy an AWS Transit Gateway with a VPN connection to secure the network tunnel, and perform multi-threaded rsync commands to copy the data directly from the NFS share to the S3 bucket.
Answer
Order multiple AWS Snowball Edge Storage Optimized devices to copy the data offline, selecting a customer managed KMS key (CMK) to encrypt the data during the job creation.
Using AWS Snowball Edge Storage Optimized devices is the most efficient method because transferring of data over a network link would take over 240 days, failing the 10-day time constraint. Additionally, Snowball Edge jobs require a customer managed KMS key (CMK) for encryption because AWS managed keys (like `aws/s3`) cannot be used to encrypt Snowball Edge jobs.
Step-by-Step Solution
Key Concept
Selecting data transfer mechanisms based on bandwidth constraints and key management policies.
Estimated Time:1m 30s