Examkin

Question

Difficulty: HardEnhancing Data Protection and Compliance

A logistics company utilizes a multi-account AWS environment managed by AWS Organizations to host its supply chain applications. Database backups of Amazon Aurora PostgreSQL clusters in the member accounts are managed by AWS Backup. To meet strict compliance and data protection guidelines, the security team requires all database backups to be copied daily to a central, isolated disaster recovery (DR) AWS account.

During implementation, the solutions architect notes that the cross-account backup copies are failing. The Aurora clusters in the member accounts are currently encrypted using default AWS-managed keys (aws/rds). The destination backup vault in the DR account is also encrypted using the default AWS-managed key (aws/backup).

Which combination of actions will resolve the copy failures and satisfy the security requirements?

  1. Re-encrypt the source Aurora clusters in the member accounts using customer managed keys (CMKs). Create a destination backup vault in the DR account encrypted with a customer managed key (CMK). Configure the destination backup vault policy to allow the member accounts to perform the backup:CopyIntoBackupVault action, and modify the destination CMK key policy to grant the member accounts permissions for cryptographic operations.Answer
  2. B
    Keep the existing AWS-managed keys configuration. Create a Service Control Policy (SCP) at the organization root that grants the backup:CopyIntoBackupVault permission to all member accounts. Attach an Amazon S3 bucket policy to the underlying destination S3 bucket in the DR account that allows cross-account writes from the member accounts.
  3. C
    Use AWS Resource Access Manager (RAM) to share the AWS-managed aws/rds keys from the member accounts with the DR account. Update the destination backup vault policy in the DR account to allow backup:CopyIntoBackupVault for the member accounts. Configure the destination key policy to allow cross-account access.
  4. D
    Re-encrypt the source Aurora clusters in the member accounts using customer managed keys (CMKs). Retain the default AWS-managed key (aws/backup) for the destination backup vault in the DR account. Update the vault policy in the DR account to allow backup:CopyIntoBackupVault from the member accounts, and modify the key policy of aws/backup to allow the member accounts to perform KMS decryption operations.

Answer

Re-encrypt the source Aurora clusters in the member accounts using customer managed keys (CMKs). Create a destination backup vault in the DR account encrypted with a customer managed key (CMK). Configure the destination backup vault policy to allow the member accounts to perform the backup:CopyIntoBackupVault action, and modify the destination CMK key policy to grant the member accounts permissions for cryptographic operations.
To successfully copy AWS Backup snapshots across accounts, both the source and target resources must be encrypted using customer managed keys (CMKs). AWS-managed keys (like aws/rds or aws/backup) cannot be shared across accounts because their key policies are managed by AWS and cannot be modified. Additionally, the destination backup vault's access policy must explicitly allow the member accounts or organization to perform the backup:CopyIntoBackupVault operation, and the destination CMK key policy must grant permissions to the source accounts' roles to perform cryptographic operations for re-encryption.

Step-by-Step Solution

1
Migrate the database encryption to Customer Managed Keys (CMKs) in the member accounts.
The Aurora database clusters and their generated snapshots will be encrypted with CMKs rather than the default aws/rds managed key.
AWS Backup does not support copying backups encrypted with AWS-managed keys across accounts. The source backups must be encrypted with a key whose policy can be modified to grant cross-account access.
2
Create a Customer Managed Key (CMK) in the disaster recovery (DR) account and associate it with a new destination backup vault.
A destination vault is created that is encrypted with a key whose policy can be customized.
During cross-account backup copies, AWS Backup must re-encrypt the snapshot at the destination. The destination key policy must be configurable to allow access to the source account roles.
3
Configure the key policy of the destination CMK in the DR account to allow AWS Backup roles from member accounts to perform KMS actions.
The source roles receive cryptographic permissions (kms:GenerateDataKey, kms:Decrypt, kms:CreateGrant) on the destination key.
Without KMS permissions, AWS Backup in the member accounts cannot encrypt the copied recovery point with the destination key.
4
Update the destination backup vault access policy to permit the member accounts to copy backups.
Allows the backup:CopyIntoBackupVault action from member accounts or the AWS Organization principal.
By default, backup vaults are private. The destination vault policy must explicitly allow cross-account copies from authorized sources.

Key Concept

AWS Backup cross-account copy operations require that both the source resources and the destination backup vault are encrypted with Customer Managed Keys (CMKs) since AWS-managed key policies cannot be modified to grant cross-account permissions.
Rate this question

Topics

Enhancing Data Protection and Compliance