A financial services company is designing a cross-account backup recovery strategy under A… — AWS Certified Solutions Architect - Professional

A financial services company is designing a cross-account backup recovery strategy under AWS Organizations. The production workload database runs in a production account (Account ID: $111122223333$ ) and stores backups in a primary backup vault. The compliance policy requires that database backups must be copied daily to a secure disaster recovery (DR) account (Account ID: $444455556666$ ) and stored in a destination backup vault. Both backup vaults must encrypt backups at rest using Customer Managed Keys (CMKs) to satisfy auditing requirements. The copy operation must be initiated from the production account and run automatically using AWS Backup. Which combination of actions should the Solutions Architect perform to configure the required security and compliance controls for this cross-account backup copy operation? (Select TWO.)

In the destination account ( $444455556666$ ), configure the key policy of the destination vault's Customer Managed Key to grant `kms:CreateGrant` and `kms:DescribeKey` permissions to the AWS Backup service role in the source production account ( $111122223333$ ).Answer
In the destination account ( $444455556666$ ), configure the Backup Vault access policy of the destination backup vault to allow the `backup:CopyIntoBackupVault` action for the AWS Backup service role in the source production account ( $111122223333$ ).Answer
C
In the source production account ( $111122223333$ ), encrypt the primary backup vault using the AWS-managed KMS key for backups (`aws/backup`), and configure the destination account's backup service role to decrypt using this key.
D
Create a Service Control Policy (SCP) in the Organizations management account that grants the `backup:CopyIntoBackupVault` permission to the source production account's backup service role, and attach the SCP to the Organizational Unit (OU) containing the destination account ( $444455556666$ ).
E
Configure a resource policy on the Amazon S3 bucket used by the destination backup vault to allow the `s3:PutObject` action for the AWS Backup service role in the source production account ( $111122223333$ ).

Answer

In the destination account, configure the key policy of the destination vault's Customer Managed Key to grant `kms:CreateGrant` and `kms:DescribeKey` permissions to the AWS Backup service role in the source production account, and configure the Backup Vault access policy of the destination backup vault to allow the `backup:CopyIntoBackupVault` action for the AWS Backup service role in the source production account.

For cross-account backup copying, the AWS Backup service role in the source account requires permissions to encrypt backups in the destination vault. To achieve this, the destination Customer Managed Key's key policy must grant `kms:CreateGrant` and `kms:DescribeKey` permissions to the source account's AWS Backup service role. Additionally, the destination vault's Backup Vault access policy must allow the `backup:CopyIntoBackupVault` action for the source service role.

Step-by-Step Solution

Ensure the source backup vault is encrypted using a Customer Managed Key (CMK) instead of the default AWS-managed key.

Allows key policy modification, which is required because AWS-managed keys cannot be shared across accounts.

AWS Backup requires a customer managed key on the source vault for cross-account copying.

Modify the KMS key policy of the destination Customer Managed Key in the destination account.

Grants `kms:CreateGrant` and `kms:DescribeKey` permissions to the AWS Backup service role of the source account.

Allows AWS Backup in the source account to encrypt the copy inside the destination vault using the destination key.

Modify the Backup Vault access policy of the destination backup vault in the destination account.

Grants `backup:CopyIntoBackupVault` permission to the AWS Backup service role in the source production account.

Authorizes the cross-account write operation at the vault level.

Key Concept

Cross-account AWS Backup copy configuration requires a Customer Managed Key (CMK) at the source and appropriate resource policies (Backup Vault access policy and KMS key policy) to authorize the cross-account encryption and write operations.

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic