Examkin

Soru

Zorluk: ZorData Encryption and Key Management

A company wants to share a daily Amazon RDS PostgreSQL database snapshot from its production AWS account (Account A) to a data analytics AWS account (Account B). The production database is encrypted at rest using an AWS KMS key. The solution must ensure that the snapshot is securely shared, decrypted, and restored in Account B while adhering to the principle of least privilege.

Which set of actions will meet these requirements?

  1. A
    Ensure the RDS database is encrypted with the default AWS managed key (aws/rds) in Account A. Modify the KMS key policy in Account A to allow Account B access. Share the DB snapshot with Account B, and then restore the DB instance directly in Account B from the shared snapshot.
  2. B
    Ensure the RDS database is encrypted with a customer managed KMS key in Account A. Store the KMS key ARN in an AWS Systems Manager Parameter Store parameter of type String. Share the DB snapshot with Account B. In Account B, restore the DB instance directly from the shared snapshot by reading the KMS key ARN from the Parameter Store.
  3. Ensure the RDS database is encrypted with a customer managed KMS key in Account A. Modify the key policy of the customer managed key in Account A to grant Account B access. Share the DB snapshot with Account B. In Account B, copy the shared DB snapshot to a new DB snapshot encrypted with a KMS key in Account B, and then restore the DB instance from the copied snapshot.Cevap
  4. D
    Ensure the RDS database is encrypted with a customer managed KMS key in Account A. Share the DB snapshot with Account B. In Account B, use the AWS account root user credentials to copy the shared DB snapshot, encrypt it with Account B's KMS key, and restore the DB instance to bypass the KMS key policy requirements in Account A.

Cevap

Ensure the RDS database is encrypted with a customer managed KMS key in Account A. Modify the key policy of the customer managed key in Account A to grant Account B access. Share the DB snapshot with Account B. In Account B, copy the shared DB snapshot to a new DB snapshot encrypted with a KMS key in Account B, and then restore the DB instance from the copied snapshot.
The correct solution uses a customer managed key (CMK) in the source account, grants the target account access to that CMK via its key policy, shares the RDS snapshot, and then copies the snapshot locally in the target account using the target account's KMS key before restoring. This complies with AWS restrictions where AWS managed keys cannot be shared, and encrypted RDS snapshots cannot be directly restored across accounts.

Adım Adım Çözüm

1
Verify key type and configure policy permissions
The RDS instance in Account A must be encrypted with a Customer Managed Key (CMK) because the default AWS managed key cannot be shared cross-account. The CMK's key policy in Account A is modified to grant Account B the permissions to decrypt and create grants.
Allows Account B to access the cryptographic operations of the key used to encrypt the source snapshot.
2
Share and copy the database snapshot
The DB snapshot is shared with Account B. Account B initiates a copy of the shared snapshot, specifying a KMS key owned by Account B to encrypt the new copy.
AWS RDS does not support restoring a shared encrypted database snapshot directly across accounts. The snapshot must be copied locally first.
3
Restore the DB instance in the target account
Account B restores the RDS DB instance from the copied snapshot that is local to Account B.
Completes the recovery process in Account B using local resources and credentials.

Anahtar Kavram

Cross-Account KMS Key Sharing and RDS Snapshot Restore Mechanics

Alternatif Yöntem

Instead of sharing and copying the snapshot directly, an alternative is to export the RDS snapshot data to an Amazon S3 bucket in Account A encrypted with a customer managed KMS key, grant Account B access to the S3 bucket and key, and then import the data into a new RDS DB instance in Account B. However, this is operationally more complex.
Tahmini Süre:2m 30s
Bu soruyu puanla

Konular

Data Encryption and Key Management

Bu konudan daha fazla soru