Examkin

Question

Difficulty: HardDatabase and Storage Strategy

A media production company is designing a collaborative video editing platform. The platform has two main requirements:

1. A relational metadata database for video clips (OLTP) that requires complex SQL queries, a recovery point objective (RPO) of under 11 minute, and a recovery time objective (RTO) of under 1515 minutes in a secondary disaster recovery region.
2. An object store for raw video assets in a central AWS account that must be securely accessed by an external vendor's IAM roles in a separate AWS account, requiring cross-account access and server-side encryption.

Which of the following database and storage strategies meets these requirements with the least operational overhead?

  1. Deploy an Amazon Aurora Global Database with the primary cluster in the primary region and a secondary cluster in the disaster recovery region. Store the raw video assets in an Amazon S3 bucket encrypted with an AWS KMS customer managed key, and configure the S3 bucket policy and KMS key policy to grant read access to the external vendor's IAM roles.Answer
  2. B
    Deploy an Amazon Aurora Global Database with the primary cluster in the primary region and a secondary cluster in the disaster recovery region. Store the raw video assets in an Amazon S3 bucket encrypted with the default AWS-managed S3 key (aws/s3), and configure the S3 bucket policy to grant read access to the external vendor's IAM roles.
  3. C
    Deploy Amazon RDS for PostgreSQL in a Multi-AZ configuration in the primary region, routing read traffic to the standby instance to optimize performance during peak hours, and set up cross-region read replicas in the secondary region. Store the raw video assets in an Amazon S3 bucket encrypted with an AWS KMS customer managed key, and configure the S3 bucket policy and KMS key policy to grant read access to the external vendor's IAM roles.
  4. D
    Deploy Amazon RDS for PostgreSQL in a Multi-AZ configuration in the primary region, using AWS Backup to replicate database backups to the secondary region to support a pilot light disaster recovery strategy. Store the raw video assets in an Amazon S3 bucket encrypted with an AWS KMS customer managed key, and configure the S3 bucket policy and KMS key policy to grant read access to the external vendor's IAM roles.

Answer

Deploy an Amazon Aurora Global Database with the primary cluster in the primary region and a secondary cluster in the disaster recovery region. Store the raw video assets in an Amazon S3 bucket encrypted with an AWS KMS customer managed key, and configure the S3 bucket policy and KMS key policy to grant read access to the external vendor's IAM roles.
The correct strategy uses Amazon Aurora Global Database to achieve near-zero RPO and low RTO because of its storage-level replication. For S3 cross-account access, a customer managed key is required because its key policy can be modified to trust the external account's IAM principal, which is not possible with AWS-managed keys like aws/s3.

Step-by-Step Solution

1
Evaluate the RTO and RPO requirements for the database.
Identify that Amazon Aurora Global Database is required to support sub-second cross-region replication (RPO under 1 minute) and failover/promotion in under 15 minutes (RTO under 15 minutes).
Standard RDS replication or backups (such as a pilot light configuration) do not meet the stringent recovery time and recovery point objectives.
2
Check the read-scaling capability of standard RDS Multi-AZ deployments.
Determine that standard RDS Multi-AZ standby instances are passive and cannot serve read traffic, which rules out routing read traffic to the standby instance.
Only Aurora Replicas or active RDS Read Replicas can be used to scale read workloads.
3
Verify cross-account S3 bucket sharing and encryption configuration.
Conclude that an AWS KMS customer managed key (CMK) must be used to encrypt the S3 bucket, with appropriate permissions granted in the KMS key policy to allow cross-account decryption.
AWS-managed KMS keys (like aws/s3) cannot be shared across different AWS accounts as their key policies cannot be modified.

Key Concept

To meet strict RTO/RPO objectives in multi-region deployments, Amazon Aurora Global Database provides active-passive cross-region physical replication with fast failover. Furthermore, S3 buckets shared across accounts must use Customer Managed Keys (CMKs) to enable decryption by external account principals, as AWS managed keys cannot be shared cross-account.
Rate this question

Topics

Database and Storage Strategy

More questions from this topic