A research organization is designing a new cloud-native genomics analysis platform. The platform handles an OLTP workload consisting of DNA sequence metadata stored in a relational database, and raw sequencing files (each averaging ) stored in Amazon S3. The relational database requires dynamic horizontal read scaling to handle sudden spikes in query volume. The disaster recovery (DR) strategy requires replicating both the database and raw sequencing files from the primary account in `us-east-1` to a secondary account in `us-west-2` with an RPO of under and an RTO of under . All data must be encrypted at rest using Customer Managed Keys (CMKs) in AWS Key Management Service (AWS KMS) to support cross-account sharing. Audit logs from the platform's S3 buckets in both regions must be written directly to a centralized S3 bucket in a separate Security Account. Which of the following database and storage architectures meets these requirements while satisfying the RTO, RPO, and security compliance constraints?
- Deploy Amazon Aurora Global Database with the primary cluster in us-east-1 and a secondary cluster in us-west-2. Configure Aurora Auto Scaling for the reader replicas in the primary cluster. Encrypt the database using customer managed KMS keys in both accounts, granting cross-account key usage permissions. Set up Amazon S3 Cross-Region Replication (CRR) between the source and destination buckets using customer managed KMS keys, allowing cross-account decryption in the replication role policy. In the Security Account, apply a bucket policy to the centralized logging bucket that explicitly allows s3:PutObject permissions from the primary and disaster recovery account IAM roles.Answer
- BDeploy Amazon RDS for PostgreSQL in a Multi-AZ configuration in us-east-1 with cross-Region read replication to us-west-2. Rely on the Multi-AZ standby instance in us-east-1 to scale read traffic dynamically. Configure S3 Cross-Region Replication between the accounts using the default AWS-managed KMS key (aws/s3) for encryption. Configure the centralized logging S3 bucket policy in the Security Account to delegate access via local IAM policies in the writing accounts.
- CDeploy Amazon Aurora PostgreSQL in us-east-1 with Aurora Auto Scaling for reader replicas. Set up an AWS Database Migration Service (DMS) continuous replication task to an Amazon RDS PostgreSQL instance in us-west-2. Configure an AWS DataSync task scheduled to run every 12 hours to copy raw sequencing files from the primary S3 bucket to the disaster recovery S3 bucket. Encrypt all resources using customer managed KMS keys. In the Security Account, configure local IAM policies to grant access to the centralized logging bucket, omitting explicit cross-account permissions in the destination bucket policy.
- DDeploy Amazon Aurora Global Database with the primary cluster in us-east-1 and a secondary cluster in us-west-2. Enable Aurora Auto Scaling for reader replicas. Encrypt the database clusters and S3 buckets using AWS-managed KMS keys (aws/rds and aws/s3). Configure Amazon S3 Cross-Region Replication (CRR) between the primary and disaster recovery accounts. In the Security Account, apply a bucket policy that grants access to the root user of the organization but does not specify the writing roles or accounts.