A SysOps administrator is tasked with establishing a cross-account, cross-Region backup so… — AWS Certified SysOps Administrator - Associate

A SysOps administrator is tasked with establishing a cross-account, cross-Region backup solution for a production Amazon RDS for PostgreSQL database. The database resides in $Account\ A$ (source) in the $\text{us-east-1}$ Region. The compliance team requires that weekly backups of this database be copied to $Account\ B$ (destination) in the $\text{us-west-2}$ Region, and that all backups remain encrypted.

The administrator configures an AWS Backup plan in $Account\ A$ to perform weekly backups and copy them to a destination backup vault in $Account\ B$ in $\text{us-west-2}$ . The copy jobs fail immediately with an access denied error. Both the source and destination backup vaults are currently encrypted using default AWS managed KMS keys.

What is the correct configuration change required to resolve this issue and successfully copy the backups?

A
Export the RDS snapshots to an Amazon S3 bucket, configure Amazon S3 Cross-Region Replication (CRR) to sync the files to a bucket in Account B in us-west-2, and disable S3 Versioning on both buckets to minimize storage costs.
B
Modify the default AWS-managed KMS key policy in Account A to grant cross-account access to Account B, and associate an IAM policy with the AWS Backup service role in Account A to delegate the decryption rights.
Create a customer managed KMS key in Account A to encrypt the source backup vault. Update the backup vault access policy in the destination vault in Account B to allow the backup:CopyIntoBackupVault action for the AWS Backup service role from Account A.Answer
D
Configure a cross-Region Read Replica of the RDS PostgreSQL database in Account B in us-west-2, disable automated backups on the primary instance in Account A, and enable automated backups on the Read Replica to handle local recovery.

Answer

Create a customer managed KMS key in the source account to encrypt the source backup vault, and update the vault access policy in the destination account's backup vault to permit copy operations from the source service role.

AWS Backup cross-account copying cannot proceed when the source backup vault is encrypted with the default AWS-managed KMS key (aws/backup) because these keys cannot be shared across accounts. A customer managed KMS key must be created and configured in the source account to encrypt the source vault. Furthermore, backup vaults are private by default; the destination vault in the destination account must have a vault access policy attached that explicitly permits the `backup:CopyIntoBackupVault` action for the AWS Backup service role in the source account.

Step-by-Step Solution

Evaluate the encryption limitations of AWS Backup cross-account copy operations.

Determine that AWS-managed KMS keys (e.g., default vault encryption keys) cannot be shared across accounts, meaning copy jobs will fail with Access Denied if the source vault uses one.

KMS key policies on default AWS-managed keys are immutable and restricted to the local account, forcing the use of a customer managed KMS key.

Re-encrypt the source backup vault in the source account using a customer managed KMS key.

The source vault is now encrypted with a key that can have its policy modified to allow cross-account access or delegated access via IAM roles.

A customer managed KMS key allows the AWS Backup service role to access the key during the copy and re-encryption phase.

Modify the destination backup vault's access policy in the destination account.

A policy is attached allowing the source account's AWS Backup service role permissions to execute `backup:CopyIntoBackupVault` on the destination vault.

By default, destination backup vaults reject external write attempts. An explicit vault access policy is required to allow incoming cross-account copies.

Key Concept

AWS Backup cross-account copy operations require customer managed KMS keys on the source vault and explicit cross-account write permissions in the destination vault access policy.

Estimated Time:3m 0s

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic