A financial services firm hosts its transactional ledger on Amazon DynamoDB tables within a Production AWS account. The tables currently use AWS owned keys for encryption at rest. To meet new compliance requirements, the solutions architect must enhance data protection by implementing customer-managed keys with automatic key rotation, and automated cross-account backups to a centralized, read-only Security account within AWS Organizations. The design must ensure that administrators in the Production account cannot modify or delete the copied backups. Which combination of actions should the solutions architect take to meet these compliance requirements? (Select TWO.)
- Update the DynamoDB tables to use a customer managed KMS key in the Production account, and enable automatic key rotation on the key.Answer
- In the Security account, create an AWS Backup vault encrypted with a customer managed KMS key, and apply a vault policy that allows the Production account to copy backups into it. In the Production account, configure an AWS Backup plan to back up the tables to a source vault encrypted with a customer managed KMS key, and configure a copy action to the Security account vault.Answer
- CModify the DynamoDB tables to use the AWS-managed KMS key aws/dynamodb. In the Security account, create an AWS Backup vault encrypted with the AWS-managed key aws/backup, and use AWS Backup to copy the backups from the Production account directly into this vault.
- DCreate a Service Control Policy (SCP) at the organization root that explicitly allows the backup:CopyIntoBackupVault action for the Production account. Rely on this SCP to grant the necessary write permissions to the destination vault in the Security account without modifying the destination vault's access policy.
- EExport the DynamoDB tables to Amazon S3 in the Security account using Amazon DynamoDB features. Configure the destination S3 bucket policy to allow the s3:PutObject action using a wildcard principal with an aws:PrincipalOrgID condition, omitting the specific root principal of the Production account.
Answer
Update the DynamoDB tables to use a customer managed KMS key in the Production account with automatic rotation. In the Security account, create a backup vault encrypted with a customer managed KMS key and configure its vault policy to allow copy actions from the Production account. In the Production account, configure an AWS Backup plan to back up the tables to a vault encrypted with a customer managed key, and add a copy action targeting the Security account vault.
Updating the DynamoDB tables to use a customer managed KMS key satisfies the requirement for encryption with automatic rotation. Furthermore, using AWS Backup with customer managed KMS keys in both the source Production account and the destination Security account enables cross-account backup replication within AWS Organizations. The destination vault policy in the Security account is configured to grant copy permissions to the Production account, which is secure and fully supported.
Step-by-Step Solution
Key Concept
Cross-account copying using AWS Backup requires the destination backup vault to be encrypted with a Customer Managed KMS key (CMK). AWS-managed KMS keys cannot be shared across accounts or have their key policies edited.
Alternative Method
While AWS Backup is the standard and recommended tool for managing compliance backups, another method involves using DynamoDB global tables replicated to a replica table in the Security account, though this does not yield point-in-time recovery backups isolated from Production delete actions as effectively as AWS Backup.
Estimated Time:3m 0s