An enterprise needs to migrate a 250\text{ TB} dataset of legacy files from an on-premises… — AWS Certified Solutions Architect - Professional

An enterprise needs to migrate a $250\text{ TB}$ dataset of legacy files from an on-premises NFS file system to an Amazon S3 bucket. The enterprise has a dedicated $100\text{ Mbps}$ network connection to AWS. The migration must be completed within a $14$ -day maintenance window. The migrated data must be encrypted at rest using an AWS Key Management Service (AWS KMS) key that allows the enterprise to delegate cross-account decryption access to an external auditing team. Which strategy should a solutions architect recommend to meet these requirements?

A
Deploy an AWS DataSync agent on-premises to transfer the data from the NFS file system to the Amazon S3 bucket over the $100\text{ Mbps}$ network connection, utilizing task scheduling and built-in compression to optimize transfer performance.
Order three AWS Snowball Edge Storage Optimized devices. Specify an AWS KMS Customer Managed Key (CMK) when creating the import jobs. Copy the data from the NFS file system to the devices using the Snowball client, and ship the devices back to AWS.Answer
C
Order three AWS Snowball Edge Storage Optimized devices. Specify the default AWS-managed key (`aws/s3`) when creating the import jobs to encrypt the objects in S3, and grant cross-account read access using the S3 bucket policy.
D
Establish an AWS Direct Connect connection with a Hosted Connection of $100\text{ Mbps}$ . Use an AWS Transit Gateway and a transit Virtual Interface (VIF) to route AWS DataSync traffic privately to an S3 interface endpoint, completing the transfer over the private network.

Answer

Order AWS Snowball Edge Storage Optimized devices and configure the import jobs to use an AWS KMS Customer Managed Key (CMK) to allow cross-account access.

The correct answer correctly identifies that transferring

250\text{ TB}

of data over a

100\text{ Mbps}

network connection takes too long, making offline migration with AWS Snowball Edge devices necessary. Additionally, it accurately points out that a Customer Managed Key (CMK) must be selected for encryption during the Snowball import configuration, because the key policy of default AWS-managed keys (`aws/s3`) cannot be edited to delegate decryption permissions to external AWS accounts.

Step-by-Step Solution

Calculate the time required to migrate

250\text{ TB}

over the existing

100\text{ Mbps}

network link.

The transfer will take approximately

231

days under ideal conditions.

This shows that an online data transfer mechanism is not viable for the

14

-day timeline, necessitating an offline data transfer using AWS Snowball Edge.

Select the appropriate storage medium for offline transfer and evaluate storage limits.

Three AWS Snowball Edge Storage Optimized devices are required to store the

250\text{ TB}

dataset.

Shipping and loading three Snowball Edge devices will comfortably take

7-10

days, which fits within the

14

-day window.

Address the security requirement to delegate decryption access to an external auditing team in another account.

Select a Customer Managed Key (CMK) instead of an AWS-managed key.

Default AWS-managed keys (like `aws/s3`) do not allow key policy customization, meaning cross-account decryption cannot be configured. A CMK allows modifying the key policy to delegate cross-account access.

Key Concept

Selecting between online and offline data migration based on bandwidth constraints, and managing cross-account access for KMS-encrypted S3 objects.

Estimated Time:2m 0s

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic