An enterprise is designing a new transactional ledger and reporting system. The workload r… — AWS Certified Solutions Architect - Professional

An enterprise is designing a new transactional ledger and reporting system. The workload requires a relational database (OLTP) that supports ACID transactions. The system must meet an RTO of less than $1$ minute and an RPO of less than $5$ seconds across a primary region ( $us-east-1$ ) and a secondary region ( $us-west-2$ ). Additionally, a separate reporting workload must run read-only queries against the database and scale dynamically to handle unpredictable spikes. Finally, database backups must be shared with a separate security audit account, where auditors must be able to decrypt and inspect the backups using Customer Managed Keys (CMKs) in AWS KMS.

Which two options should the solutions architect select to implement a database and storage strategy that meets these requirements?

Configure an Amazon Aurora Global Database with the primary cluster in $us-east-1$ and a secondary cluster in $us-west-2$ . Configure Aurora Auto Scaling for the Aurora Replicas in both regions to scale reader instances horizontally based on CPU utilization.Answer
Encrypt the Aurora database clusters using Customer Managed Keys (CMKs) in AWS KMS. Create a custom cluster snapshot, share it with the audit account, and configure the KMS key policy in the primary account to allow the audit account's IAM principal to use the CMK for decryption.Answer
C
Configure Amazon RDS for PostgreSQL with a Multi-AZ deployment in the primary region. Direct the reporting queries to the standby replica instance in the secondary Availability Zone, and enable Auto Scaling on the standby instance to dynamically increase its compute size.
D
Encrypt the database clusters using the AWS-managed KMS key for RDS (`aws/rds`). Share the automated database snapshots with the audit account, and configure an IAM policy in the audit account to allow the audit IAM role to perform cross-account KMS decryption operations on the AWS-managed key.
E
Configure an Amazon RDS for PostgreSQL database in $us-east-1$ with AWS Backup replication to $us-west-2$ . During a failover event, restore the database from the replicated backup in $us-west-2$ to meet the disaster recovery objectives.

Answer

Configure Amazon Aurora Global Database with horizontal auto scaling for reader instances, and encrypt the clusters with AWS KMS Customer Managed Keys (CMKs), sharing custom snapshots and modifying the key policy to delegate cross-account access.

The correct strategy combines Amazon Aurora Global Database for high availability, low-latency cross-region replication, and horizontally scaling read-replicas, with AWS KMS Customer Managed Keys (CMKs) for encrypted snapshot sharing. Aurora Global Database supports cross-region replication with an RPO under

5

seconds and an RTO under

1

minute via managed failover. Using CMKs is required because cross-account snapshot sharing is not supported with AWS-managed keys (`aws/rds`), and the KMS key policy must be updated to delegate decrypt permissions to the audit account.

Step-by-Step Solution

Analyze HA/DR requirements to select the database replication strategy.

Determine that an active-passive cross-region architecture using Amazon Aurora Global Database is necessary to meet the RTO of less than

1

minute and RPO of less than

5

seconds.

Standard backup restoration patterns cannot meet the strict recovery time objective.

Evaluate read-scaling strategies for the reporting tier.

Configure Aurora Auto Scaling to dynamically spin up and down reader instances based on CPU utilization.

RDS standby instances in Multi-AZ are passive and cannot serve read queries, necessitating Aurora reader scaling.

Determine the encryption and sharing configuration for cross-account snapshot access.

Encrypt database volumes using a Customer Managed Key (CMK), share a custom snapshot, and update the KMS key policy to permit the audit account's role to decrypt.

AWS-managed KMS keys do not allow policy modification and cannot be used for cross-account sharing.

Key Concept

Designing multi-region, highly available database topologies with horizontal read scaling and secure cross-account KMS key sharing.

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic