Question

Difficulty: HardDatabase and Storage Strategy

A research organization is designing a new cloud-native genomics analysis platform. The platform handles an OLTP workload consisting of DNA sequence metadata stored in a relational database, and raw sequencing files (each averaging 150 MB150\text{ MB}) stored in Amazon S3. The relational database requires dynamic horizontal read scaling to handle sudden spikes in query volume. The disaster recovery (DR) strategy requires replicating both the database and raw sequencing files from the primary account in `us-east-1` to a secondary account in `us-west-2` with an RPO of under 5 minutes5\text{ minutes} and an RTO of under 15 minutes15\text{ minutes}. All data must be encrypted at rest using Customer Managed Keys (CMKs) in AWS Key Management Service (AWS KMS) to support cross-account sharing. Audit logs from the platform's S3 buckets in both regions must be written directly to a centralized S3 bucket in a separate Security Account. Which of the following database and storage architectures meets these requirements while satisfying the RTO, RPO, and security compliance constraints?

  1. Deploy Amazon Aurora Global Database with the primary cluster in us-east-1 and a secondary cluster in us-west-2. Configure Aurora Auto Scaling for the reader replicas in the primary cluster. Encrypt the database using customer managed KMS keys in both accounts, granting cross-account key usage permissions. Set up Amazon S3 Cross-Region Replication (CRR) between the source and destination buckets using customer managed KMS keys, allowing cross-account decryption in the replication role policy. In the Security Account, apply a bucket policy to the centralized logging bucket that explicitly allows s3:PutObject permissions from the primary and disaster recovery account IAM roles.Answer
  2. B
    Deploy Amazon RDS for PostgreSQL in a Multi-AZ configuration in us-east-1 with cross-Region read replication to us-west-2. Rely on the Multi-AZ standby instance in us-east-1 to scale read traffic dynamically. Configure S3 Cross-Region Replication between the accounts using the default AWS-managed KMS key (aws/s3) for encryption. Configure the centralized logging S3 bucket policy in the Security Account to delegate access via local IAM policies in the writing accounts.
  3. C
    Deploy Amazon Aurora PostgreSQL in us-east-1 with Aurora Auto Scaling for reader replicas. Set up an AWS Database Migration Service (DMS) continuous replication task to an Amazon RDS PostgreSQL instance in us-west-2. Configure an AWS DataSync task scheduled to run every 12 hours to copy raw sequencing files from the primary S3 bucket to the disaster recovery S3 bucket. Encrypt all resources using customer managed KMS keys. In the Security Account, configure local IAM policies to grant access to the centralized logging bucket, omitting explicit cross-account permissions in the destination bucket policy.
  4. D
    Deploy Amazon Aurora Global Database with the primary cluster in us-east-1 and a secondary cluster in us-west-2. Enable Aurora Auto Scaling for reader replicas. Encrypt the database clusters and S3 buckets using AWS-managed KMS keys (aws/rds and aws/s3). Configure Amazon S3 Cross-Region Replication (CRR) between the primary and disaster recovery accounts. In the Security Account, apply a bucket policy that grants access to the root user of the organization but does not specify the writing roles or accounts.

Answer

Deploy Amazon Aurora Global Database with reader auto scaling in the primary region, using customer managed KMS keys to encrypt the database and Amazon S3 buckets to allow cross-account sharing and replication, and configure the destination centralized S3 bucket policy to allow writes from the member account IAM roles.
The correct architecture uses Amazon Aurora Global Database to achieve low replication latency, enabling a secondary cluster in the disaster recovery region to satisfy the RTO and RPO. Read scaling in the primary region is addressed by configuring Aurora Auto Scaling on reader instances. To support cross-account replication, customer managed KMS keys are required since AWS-managed KMS keys cannot be shared across accounts. Raw sequencing files are copied via S3 Cross-Region Replication (CRR) utilizing customer managed keys for decryption/encryption delegation. Finally, cross-account log delivery to the Security Account is permitted by configuring a bucket policy that grants write permissions to the source accounts' IAM roles.

Step-by-Step Solution

1
Evaluate read scalability and cross-region database replication requirements.
Amazon Aurora Global Database provides sub-second replication latency across regions (meeting RPO and RTO) and supports scaling readers dynamically via Aurora Auto Scaling. Amazon RDS Multi-AZ standbys cannot serve read traffic.
To satisfy horizontal read scaling in the primary region and cross-region business continuity constraints.
2
Assess the encryption and cross-account sharing capabilities of AWS KMS key types.
Customer managed KMS keys (CMKs) must be utilized. AWS-managed KMS keys (such as aws/rds and aws/s3) cannot be shared with external AWS accounts, which would block cross-account database replication and S3 Cross-Region Replication decryption.
To satisfy security compliance requiring encryption at rest while maintaining cross-account functionality.
3
Determine S3 replication scheduling to meet the required recovery point objective.
Configure S3 Cross-Region Replication (CRR) with the replication role authorized to use the customer managed keys. AWS DataSync running on a 12-hour schedule is rejected as it violates the 5-minute RPO constraint.
To ensure continuous replication of genomics raw files within the 5-minute RPO window.
4
Evaluate S3 bucket policy requirements for cross-account log shipping.
The destination bucket in the Security Account must have a bucket policy that grants s3:PutObject permissions to the specific logging IAM roles in the source accounts.
Because IAM policies alone in source accounts cannot authorize access to resources owned by another AWS account.

Key Concept

Cross-account database and object storage replication with KMS customer managed keys and centralized logging permissions.
Estimated Time:2m 30s
Rate this question