A logistics enterprise is designing a new high-throughput supply chain tracking application (OLTP and Object storage workloads). The application database must handle unpredictable surges in read queries, and must maintain a recovery time objective (RTO) of less than 5 minutes and a recovery point objective (RPO) of less than 1 minute across two AWS Regions. Additionally, application transaction logs and database backups must be continuously archived to a centralized, encrypted Amazon S3 bucket located in a separate dedicated security AWS account. Which database and storage architecture meets these requirements while ensuring secure cross-account data access?
- ADeploy Amazon RDS for PostgreSQL in a Multi-AZ configuration in the primary Region and rely on the standby instance to handle read query surges. Configure an RDS Read Replica in the secondary Region to meet the disaster recovery objectives. Store the backups and logs in the security account's S3 bucket, encrypted with a Customer Managed Key (CMK) in the security account, and update the CMK key policy and the S3 bucket policy to allow access from the database account.
- Deploy Amazon Aurora PostgreSQL with Aurora Replicas and configure Aurora Auto Scaling. Implement Aurora Global Database to replicate data to the secondary Region. Store the backups and logs in the security account's S3 bucket, encrypted with a Customer Managed Key (CMK) in the security account, and update the CMK key policy and the S3 bucket policy to allow access from the database account.Cevap
- CDeploy Amazon Aurora PostgreSQL with Aurora Replicas and configure Aurora Auto Scaling. Implement Aurora Global Database to replicate data to the secondary Region. Store the backups and logs in the security account's S3 bucket, encrypted with the default AWS-managed KMS key for Amazon S3 (aws/s3) in the security account, and update the S3 bucket policy to allow access from the database account.
- DDeploy Amazon Aurora PostgreSQL with Aurora Replicas and configure Aurora Auto Scaling. Set up a pilot light disaster recovery strategy by copying automated database snapshots hourly to the secondary Region. Store the backups and logs in the security account's S3 bucket, encrypted with a Customer Managed Key (CMK) in the security account, and update the CMK key policy and the S3 bucket policy to allow access from the database account.
Cevap
The architecture that combines Amazon Aurora Global Database for multi-Region replication, Aurora Auto Scaling for read capacity, and cross-account S3 backup storage encrypted with a Customer Managed Key (CMK) from the security account.
Amazon Aurora PostgreSQL with Aurora Replicas and Aurora Auto Scaling handles read surges effectively because Aurora Replicas share the same storage volume and scale out horizontally. Aurora Global Database uses storage-based, asynchronous replication that achieves an RPO of less than 1 minute and an RTO of less than 5 minutes. For cross-account S3 access with KMS encryption, using a Customer Managed Key (CMK) in the destination (security) account is required because its key policy can be modified to grant the source (database/app) account permissions (kms:GenerateDataKey and kms:Decrypt), which allows successful write and read operations across accounts.
Adım Adım Çözüm
Anahtar Kavram
Designing highly available, scalable databases with low-RTO/RPO multi-Region disaster recovery, combined with secure, cross-account encrypted storage configurations using Customer Managed Keys (CMKs).
Tahmini Süre:3m 0s