An enterprise is planning to migrate a 3.2\text{ PB} unstructured dataset from an on-premi… — AWS Certified Solutions Architect - Professional

An enterprise is planning to migrate a $3.2\text{ PB}$ unstructured dataset from an on-premises high-performance NFS file system to Amazon S3. The migration must be completed within a strict timeline of $14\text{ days}$ during an upcoming datacenter decommissioning event. The company has a dedicated $10\text{ Gbps}$ AWS Direct Connect connection, but only $2.5\text{ Gbps}$ of this connection can be allocated for migration traffic due to concurrent production workloads. Post-migration, the data must be encrypted at rest using a Key Management Service (KMS) key that is shared across multiple AWS accounts to support cross-account collaborative analytics. Furthermore, on-premises applications will continue reading and writing to the NFS share until the final cutover, meaning that any changes written during the bulk data transfer phase must be synchronized to AWS. Which of the following migration strategies is the most efficient and compliant?

A
Deploy AWS DataSync agents on-premises and configure a Transit Gateway with a Direct Connect gateway to route migration traffic over a Transit Gateway Connect attachment. Run multiple concurrent DataSync tasks to copy the entire $3.2\text{ PB}$ dataset directly to the destination Amazon S3 bucket over the dedicated link within the $14\text{-day}$ window.
B
Order AWS Snowball Edge Storage Optimized devices to execute the bulk migration. Set up the target Amazon S3 bucket to use the default AWS-managed KMS key (`aws/s3`) for encryption at rest to simplify security configuration. Deploy AWS DataSync agents to perform incremental delta syncs over the Direct Connect connection, and modify the key policy of the default key to grant cross-account permissions.
C
Provision an AWS Transfer Family SFTP endpoint configured to write directly to the target Amazon S3 bucket. Package the $3.2\text{ PB}$ dataset into compressed archives on-premises and use a custom script to parallelize SFTP uploads over the Direct Connect link via a Transit Gateway that lacks a Transit Gateway route table association for the target VPC.
Order AWS Snowball Edge Storage Optimized devices to perform the initial bulk transfer. Configure the target Amazon S3 bucket to use a Customer Managed Key (CMK) for encryption at rest and configure its key policy to allow cross-account access. Once the bulk data is imported into Amazon S3, deploy AWS DataSync agents on-premises to sync the active delta updates over the Direct Connect connection, ensuring the DataSync task execution role has decrypt and encrypt permissions for the CMK.Answer

Answer

The correct strategy is to use AWS Snowball Edge Storage Optimized devices for the initial bulk transfer, encrypt the target Amazon S3 bucket with a Customer Managed Key (CMK) that allows cross-account permissions, and use AWS DataSync over the Direct Connect connection to sync the delta updates before cutover.

The correct strategy uses AWS Snowball Edge Storage Optimized devices to bypass the network bottleneck for the initial

3.2\text{ PB}

bulk data transfer, which is the only way to meet the

14\text{-day}

limit. It correctly implements a Customer Managed Key (CMK) to allow cross-account sharing of the encrypted data, and uses AWS DataSync to copy the changes made to the NFS share during the Snowball transfer process.

Step-by-Step Solution

Calculate the theoretical maximum data transfer capacity over the available network link.

2.5\text{ Gbps}

throughput, the maximum data that can be transferred in

24\text{ hours}

2.5 \times 10^9 \times 86400 / 8 \approx 27\text{ TB}

per day. Over

14\text{ days}

, this allows a maximum transfer of

\approx 378\text{ TB}

, which is far below the

3.2\text{ PB}

requirement.

This step determines whether an online network migration or an offline physical shipment is required.

Select the appropriate AWS transfer service for bulk data transfer based on the time constraints.

Identify that AWS Snowball Edge Storage Optimized devices must be ordered to parallelize and handle the initial offline bulk migration of

3.2\text{ PB}

Offline transport is the only mechanism that can complete the bulk migration within the

14\text{-day}

decommission window.

Evaluate key management options for cross-account data access.

Choose a Customer Managed Key (CMK) in AWS KMS because AWS-managed keys (`aws/s3`) cannot be shared across multiple AWS accounts or have their policies modified.

This satisfies the requirement to support post-migration cross-account collaborative analytics.

Establish a delta synchronization mechanism for active writes.

Deploy AWS DataSync agents on-premises to sync active updates over the Direct Connect connection after the Snowball devices are imported. Ensure the DataSync execution role has permissions to use the CMK.

DataSync can identify and copy only the changed files (deltas) over the network, which fits easily within the

2.5\text{ Gbps}

bandwidth limit.

Key Concept

Selecting data transfer tools based on network constraints and configuring Customer Managed Keys for cross-account compliance.

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic