Examkin

Question

Difficulty: HardDatabase and Storage Strategy

A healthcare enterprise is designing a new cloud-native patient monitoring platform. The architecture comprises a high-throughput telemetry service (NoSQL database workload) and a medical imaging archiving service (Object storage workload). The solution must span two AWS accounts: a Production account (where applications run in the us-east-1 primary region and us-west-2 secondary region) and a centralized Security account.

The system must satisfy the following design constraints:
- Telemetry database writes must support low-latency ingest, and read availability must be maintained in both regions. The disaster recovery requirements dictate a Recovery Time Objective (RTO) of less than 10 minutes and a Recovery Point Objective (RPO) of less than 1 minute.
- Imaging reports must be written directly from application servers in the Production account to an Amazon S3 bucket in the Security account.
- The S3 bucket data must be encrypted at rest. To comply with corporate audits, the encryption keys must support custom rotation schedules and policy-based delegation. The application servers in the Production account must have permission to upload objects and read them back.

Which database and storage strategy meets these requirements?

  1. Deploy Amazon DynamoDB global tables in the Production account across us-east-1 and us-west-2. In the Security account, create the S3 bucket and an AWS KMS Customer Managed Key (CMK). Configure the CMK's key policy to grant the Production account IAM roles permissions for kms:GenerateDataKey and kms:Decrypt, and configure the S3 bucket policy to grant the Production IAM roles permissions for s3:PutObject and s3:GetObject.Answer
  2. B
    Deploy Amazon DynamoDB global tables in the Production account across us-east-1 and us-west-2. In the Security account, create the S3 bucket and configure it to use the default AWS-managed KMS key (aws/s3) for encryption. Configure the S3 bucket policy to grant the Production IAM roles permissions for s3:PutObject and s3:GetObject.
  3. C
    Deploy Amazon RDS for PostgreSQL in us-east-1 with a Multi-AZ deployment. To handle query scaling and ensure high availability, configure the application to write to the primary DB instance and read from both the primary instance and the Multi-AZ standby instance. In the Security account, create the S3 bucket and an AWS KMS Customer Managed Key (CMK), granting key policy and bucket policy access to the Production IAM roles.
  4. D
    Deploy a single-region Amazon DynamoDB table in us-east-1. Use AWS Backup to take daily backups of the DynamoDB table and copy them to us-west-2 for disaster recovery. In the Security account, create the S3 bucket and an AWS KMS Customer Managed Key (CMK), granting key policy and bucket policy access to the Production IAM roles.

Answer

Deploy Amazon DynamoDB global tables in the Production account across us-east-1 and us-west-2. In the Security account, create the S3 bucket and an AWS KMS Customer Managed Key (CMK). Configure the CMK's key policy to grant the Production account IAM roles permissions for kms:GenerateDataKey and kms:Decrypt, and configure the S3 bucket policy to grant the Production IAM roles permissions for s3:PutObject and s3:GetObject.
The correct answer provides a database strategy that utilizes Amazon DynamoDB global tables, which replicate data across regions in less than a second. This satisfies the RPO requirement of less than 1 minute and enables near-zero RTO during failover. For storage, it uses a Customer Managed Key (CMK) in the destination Security account. Unlike AWS-managed keys, a Customer Managed Key has a modifiable key policy that can grant cross-account permissions (such as kms:GenerateDataKey and kms:Decrypt) to the Production account IAM roles. This, combined with the S3 bucket policy permissions, allows the application servers to write and read the encrypted medical reports.

Step-by-Step Solution

1
Analyze the database requirements for telemetry: low-latency, active-active multi-region, RPO < 1 minute, RTO < 10 minutes.
Amazon DynamoDB global tables replicate asynchronously across regions in less than a second, meeting the RPO/RTO goals.
DynamoDB global tables offer active-active replication suitable for low-latency writes and rapid cross-region recovery.
2
Analyze the storage and encryption requirements for S3: S3 bucket in a separate Security account, cross-account access, KMS encryption with compliance controls (rotation, custom policy).
AWS-managed KMS keys (aws/s3) cannot be shared across accounts. A Customer Managed Key (CMK) must be created in the Security account with cross-account access delegated via its key policy.
Only Customer Managed Keys support key policy modifications to grant cross-account permissions to the Production account IAM roles.
3
Establish the resource permissions: update the S3 bucket policy in the Security account and the key policy of the CMK.
The Production account's IAM roles are allowed to perform s3:PutObject and s3:GetObject on the bucket, and kms:GenerateDataKey and kms:Decrypt on the CMK.
Both S3 permissions and KMS key permissions must be present for a cross-account IAM role to successfully upload and retrieve KMS-encrypted S3 objects.

Key Concept

Designing secure cross-account S3 object storage with KMS Customer Managed Keys, combined with active-active DynamoDB global tables for low RTO/RPO multi-region workloads.
Rate this question

Topics

Database and Storage Strategy

More questions from this topic