Examkin

Question

Difficulty: MediumBackup and Restore Management

A SysOps Administrator is designing a centralized backup strategy using AWS Backup. The administrator needs to automatically copy weekly backups of Amazon EBS volumes from multiple member accounts in an AWS Organization to a centralized backup vault in a dedicated disaster recovery account. Which combination of actions must the administrator take to allow these cross-account copies? (Select TWO.)

  1. Enable the cross-account backup feature in the AWS Backup console from the AWS Organizations management account.Answer
  2. Apply a backup vault access policy to the centralized backup vault in the destination account that grants permission to the member accounts to copy backups.Answer
  3. C
    Ensure both the source and destination backup vaults are encrypted using the default AWS Backup managed KMS key (aws/backup).
  4. D
    Establish an Amazon S3 Cross-Region Replication (CRR) rule to transfer the backup vault data to the destination account without enabling bucket versioning.
  5. E
    Deploy a database Read Replica in the centralized backup account to automatically synchronize and fail over backup vault metadata.

Answer

To perform cross-account backup copying in AWS Backup, you must enable the cross-account backup setting in the AWS Organizations management account and apply a vault access policy to the destination backup vault allowing the member accounts to copy backups.
The combination of enabling cross-account backup in the AWS Organizations management account and configuring a resource-based vault access policy on the destination backup vault correctly establishes the permissions needed for AWS Backup to copy recovery points across accounts. This setup allows source accounts to perform copy operations into the destination vault within the AWS Organization.

Step-by-Step Solution

1
Enable cross-account backup at the organization level.
Allows AWS Backup to initiate copy actions between member accounts within the same organization.
By default, AWS Backup does not allow copying backups across accounts until the feature is enabled in the Organizations management account.
2
Configure the resource-based access policy on the destination backup vault.
Grants permission to the source member accounts or the organization to write to the destination backup vault.
The destination backup vault requires permission to allow the backup:CopyIntoBackupVault action from external source accounts.
3
Avoid using default AWS-managed KMS keys for backup encryption.
Ensures that recovery points can be copied across accounts using customer managed KMS keys.
AWS Backup does not support cross-account copying when the backup is encrypted with the default AWS-managed KMS key.

Key Concept

Centralized cross-account backup management using AWS Backup and AWS Organizations.
Rate this question

Topics

Backup and Restore Management

More questions from this topic