A logistics enterprise is designing a real-time global shipment tracking system. The syste… — AWS Certified Solutions Architect - Professional

A logistics enterprise is designing a real-time global shipment tracking system. The system must process high-frequency status updates (OLTP NoSQL) from delivery agents across two primary regions: $us-east-1$ and $eu-west-1$ . Read and write operations must be supported locally in both regions with sub- $10\text{ ms}$ latency, automatically resolving write conflicts based on the latest physical timestamp. The disaster recovery requirements specify a Recovery Time Objective (RTO) of less than $1\text{ minute}$ and a Recovery Point Objective (RPO) of less than $10\text{ seconds}$ . Furthermore, the raw tracking telemetry must be exported hourly to an Amazon S3 bucket located in a centralized analytics AWS account within a separate AWS organization. Corporate security policies require all data at rest to be encrypted. To prevent unauthorized access, the encryption keys must support cross-account policy delegation, and the destination S3 bucket must enforce secure transport. Which database and storage architecture meets these requirements with the lowest operational complexity?

Deploy Amazon DynamoDB global tables replicated between $us-east-1$ and $eu-west-1$ , encrypted using regional Customer Managed Keys (CMKs) in AWS KMS. Configure an Amazon EventBridge Scheduler rule to trigger an AWS Lambda function hourly that reads from DynamoDB and writes to the centralized S3 bucket. Ensure the S3 bucket in the analytics account is encrypted using a Customer Managed Key (CMK) owned by the analytics account with a key policy allowing cross-account access, and its bucket policy denies `s3:PutObject` requests without secure transport or the correct KMS encryption headers.Answer
B
Deploy Amazon Aurora Global Database PostgreSQL with write forwarding enabled from $eu-west-1$ to $us-east-1$ . Encrypt the database clusters using default AWS-managed KMS keys (`aws/rds`). Configure Aurora Auto Scaling on the reader instances in the secondary region to handle scaling and write latency. Export data hourly to the centralized S3 bucket encrypted with the AWS-managed KMS key (`aws/s3`) by delegating cross-account access through an IAM role policy in the source account.
C
Deploy a single-region Amazon DynamoDB table in $us-east-1$ encrypted with a Customer Managed Key (CMK). Configure Amazon S3 Cross-Region Replication (CRR) to replicate hourly table backups to $eu-west-1$ to implement a Pilot Light disaster recovery strategy. Run a cron job on an Amazon EC2 instance to export the DynamoDB table data hourly, encrypt it using the default AWS-managed S3 key (`aws/s3`), and transfer it to the S3 bucket in the centralized analytics account.
D
Deploy Amazon DynamoDB global tables replicated between $us-east-1$ and $eu-west-1$ , encrypted using the default AWS-managed KMS key (`aws/dynamodb`). Configure a centralized S3 bucket in the analytics account encrypted with the AWS-managed KMS key (`aws/s3`). Configure an AWS Glue ETL job to run hourly, fetching data from DynamoDB and writing to the S3 bucket. Add a cross-account IAM policy to the Glue execution role in the source account to allow access to the target S3 bucket and its AWS-managed KMS key.

Answer

Deploy Amazon DynamoDB global tables with regional Customer Managed Keys (CMKs), and export the data hourly to the centralized S3 bucket encrypted with an analytics-account-owned CMK configured for cross-account access.

The correct design uses Amazon DynamoDB global tables to satisfy the OLTP NoSQL requirement, achieving sub-10 ms read/write latency in both regions with active-active write capability and near-zero RPO. For the cross-organization S3 export, using Customer Managed Keys (CMKs) in the target account is necessary because their key policies can be modified to grant cross-account permissions. Enforcing secure transport via S3 bucket policies fulfills the security requirement.

Step-by-Step Solution

Analyze the database requirements for latency, workload type, and replication.

The system requires an OLTP NoSQL database with local read/write access under 10 ms in both regions, conflict resolution, RTO < 1 minute, and RPO < 10 seconds. Amazon DynamoDB global tables meet all of these criteria by providing multi-region active-active replication with low latency and default last-write-wins physical timestamp conflict resolution.

Eliminates single-region options (which fail latency/DR metrics) and relational databases like Aurora (where cross-region write forwarding violates the latency requirement).

Evaluate the encryption and cross-organization sharing constraints.

Exporting data to an S3 bucket in a separate AWS organization requires cross-account permissions. This applies to both the S3 bucket policy and the KMS key policy used to encrypt the S3 objects.

AWS-managed KMS keys (such as `aws/s3` or `aws/dynamodb`) cannot be shared cross-account because their key policies are read-only and cannot be modified. Thus, Customer Managed Keys (CMKs) must be used.

Verify compliance and transport controls.

The destination S3 bucket policy must enforce encryption at rest and secure transport (SSL/TLS) via `aws:SecureTransport` denials, and use a CMK owned by the destination account with policy delegation to the source account role.

Ensures that security policies are met while allowing authorized cross-account writes to succeed.

Key Concept

Multi-region active-active database design using DynamoDB Global Tables, combined with secure cross-account data sharing using AWS KMS Customer Managed Keys (CMKs) and S3 bucket policies.

Estimated Time:2m 30s

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic