Examkin

Question

Difficulty: MediumDatabase and Storage Strategy

A company is designing a new transactional retail application on AWS. The application requires a highly available relational database (OLTP workload) that can automatically scale to handle sudden bursts of read traffic. In addition, the application must write daily transaction logs to an Amazon S3 bucket. These logs must be shared with a centralized compliance account. The compliance account needs to read the logs using cross-account IAM roles, and the logs must be encrypted at rest. Which two options should the solutions architect select to meet these database and storage requirements? (Choose two.)

  1. Deploy an Amazon Aurora PostgreSQL DB cluster with a Multi-AZ configuration and enable Aurora Auto Scaling for the Aurora Replicas to handle the read traffic bursts.Answer
  2. B
    Deploy an Amazon RDS for PostgreSQL database with a Multi-AZ deployment and configure an Auto Scaling policy on the standby instance to handle read traffic bursts.
  3. Store the logs in an Amazon S3 bucket, configure the bucket policy to grant read access to the compliance account's IAM role, and encrypt the bucket using a Customer Managed KMS key with a key policy that permits cross-account access.Answer
  4. D
    Store the logs in an Amazon S3 bucket, configure the bucket policy to grant read access to the compliance account's IAM role, and encrypt the bucket using the AWS managed KMS key (aws/s3).
  5. E
    Store the logs in an Amazon S3 bucket, encrypt the bucket using a Customer Managed KMS key, and rely solely on IAM policies in the compliance account to delegate access, without modifying the S3 bucket policy in the application account.

Answer

Deploying an Amazon Aurora PostgreSQL DB cluster with Aurora Auto Scaling for replicas, and configuring the Amazon S3 bucket with a custom bucket policy and a Customer Managed KMS key that allows cross-account access.
To handle sudden bursts of read traffic on a highly available relational database, Amazon Aurora PostgreSQL is suitable because it supports Multi-AZ deployment and horizontal read scaling via Aurora Replicas, which can auto-scale dynamically. For cross-account access to encrypted S3 resources, a Customer Managed KMS key must be used because AWS managed KMS keys (such as aws/s3) cannot be shared across accounts. Additionally, both the S3 bucket policy in the source account and the IAM policy in the compliance account must explicitly permit the access.

Step-by-Step Solution

1
Evaluate the database tier requirements for high availability and read scaling.
Determine that Amazon Aurora with Auto Scaling replicas is appropriate because Amazon RDS standby instances in a Multi-AZ deployment are passive and cannot serve read traffic.
This design satisfies the high availability and database read capacity scaling requirements.
2
Evaluate the storage encryption requirements for cross-account access.
Identify that AWS managed keys (aws/s3) cannot be shared across accounts, requiring a Customer Managed KMS key.
Cross-account access to KMS-encrypted resources requires key policies that can be customized, which is only supported by Customer Managed Keys.
3
Evaluate the S3 cross-account access control requirements.
Determine that both the IAM policy in the compliance account and the S3 bucket policy in the application account must grant permissions.
Cross-account access to S3 resources is only allowed if both the bucket owner and the IAM identity owner permit it.

Key Concept

Database read scaling and secure cross-account storage encryption strategy
Rate this question

Topics

Database and Storage Strategy

More questions from this topic