An enterprise needs to migrate 140\text{ TB} of document archives from an on-premises NFS … — AWS Certified Solutions Architect - Professional

An enterprise needs to migrate $140\text{ TB}$ of document archives from an on-premises NFS file system to an Amazon S3 bucket in a target AWS account. The enterprise has a $100\text{ Mbps}$ internet connection available for this migration. The migration must be completed within $25\text{ days}$ . The data must be encrypted at rest in Amazon S3 using a customer managed key (CMK) in AWS KMS. Which of the following is the most efficient and secure method to perform this migration?

Create an import job for two AWS Snowball Edge Storage Optimized devices in the target AWS account, specifying the target S3 bucket and a customer managed KMS key. Ship the devices to the on-premises datacenter, copy the NFS data to the devices, and ship them back to AWS.Answer
B
Deploy AWS DataSync agents on-premises, establish an AWS Site-to-Site VPN over the internet, and configure a DataSync task to sync the NFS data directly to the S3 bucket in the target account using the customer managed KMS key.
C
Create an import job for two AWS Snowball Edge Storage Optimized devices in the source AWS account, specifying the target S3 bucket in the target AWS account, and encrypting the data using the default AWS managed key (aws/s3). Copy the NFS data to the devices and ship them back to AWS.
D
Configure an AWS Transit Gateway with a VPN connection to the on-premises network, deploy AWS DataSync agents on-premises, and set up transitive routing through the Transit Gateway to transfer the data over the network to the S3 bucket utilizing the customer managed KMS key.

Answer

Create an import job for two AWS Snowball Edge Storage Optimized devices in the target AWS account, specifying the target S3 bucket and a customer managed KMS key. Ship the devices to the on-premises datacenter, copy the NFS data to the devices, and ship them back to AWS.

The correct option correctly identifies that network transfer is infeasible due to the timeline limit of

25\text{ days}

and bandwidth of

100\text{ Mbps}

. Using two AWS Snowball Edge Storage Optimized devices (each providing

80\text{ TB}

of usable storage) allows physical transport of the

140\text{ TB}

dataset. Creating the import job in the target AWS account and using a customer managed KMS key ensures that permissions are correctly configured for secure data ingest into the destination S3 bucket.

Step-by-Step Solution

Calculate the theoretical and realistic online transfer time for

140\text{ TB}

over a

100\text{ Mbps}

link.

100\text{ Mbps}

, the transfer takes approximately

130\text{ days}

under 100% efficiency, which is far beyond the required

25\text{ days}

. This mandates an offline physical migration path.

Determining network transfer limitations ensures that physical shipment is selected instead of online synchronization.

Determine the type and quantity of Snow family devices required.

AWS Snowball Edge Storage Optimized devices provide

80\text{ TB}

of usable storage capacity. Two devices are needed to accommodate the

140\text{ TB}

dataset.

Selecting the correct hardware capacity ensures all data fits on the shipped devices.

Determine the account context and KMS key constraints for the Snowball job.

Create the Snowball Edge import job directly in the target AWS account where the destination S3 bucket resides, and select a customer managed key (CMK) for encryption because AWS managed keys (aws/s3) cannot be modified to authorize the Snowball service or cross-account access.

AWS Snowball Edge requires custom policy configurations on KMS CMKs to encrypt the imported data successfully into the target bucket.

Key Concept

Selecting between online network transit and offline physical shipping based on bandwidth constraints, and configuring target account encryption keys under AWS KMS policies.

Estimated Time:3m 0s

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic