Examkin

Soru

Zorluk: ZorDatabase Migration and Schema Conversion using DMS and SCT

An enterprise needs to replicate changes from an on-premises Microsoft SQL Server instance to a target Amazon Aurora PostgreSQL DB cluster using AWS DMS. The SQL Server instance has Transparent Data Encryption (TDE) enabled. The migration team has already converted the database schema using the AWS Schema Conversion Tool (AWS SCT). To achieve a near-zero downtime cutover, the AWS DMS task must run with ongoing replication (CDC) enabled while keeping the source database encrypted.

What must the migration team configure to enable the AWS DMS replication task to decrypt and read the source transaction logs during CDC?

  1. A
    Configure the AWS DMS source endpoint to use the MS-REPLICATION method, which reads change data directly from the system tables decrypted in-memory by the SQL Server engine.
  2. Export the TDE certificate and private key from the SQL Server source, import them into the AWS DMS certificate store, and associate the certificate ARN with the source endpoint.Cevap
  3. C
    Disable Transparent Data Encryption (TDE) on the source SQL Server database before starting the replication task, as AWS DMS does not support CDC on encrypted databases.
  4. D
    Store the TDE certificate in AWS Secrets Manager encrypted with the AWS-managed KMS key `aws/secretsmanager`, and reference the secret ARN in the source endpoint's extra connection attributes.

Cevap

Export the TDE certificate and private key from the SQL Server source, import them into the AWS DMS certificate store, and associate the certificate ARN with the source endpoint.
To perform ongoing replication (CDC) from an on-premises Microsoft SQL Server source database that has Transparent Data Encryption (TDE) enabled, AWS DMS must have access to the certificate and private key used to encrypt the database. This allows AWS DMS to decrypt the transaction logs during replication. The migration team must export the TDE certificate and private key, import them into the AWS DMS certificate store, and associate the certificate ARN with the source endpoint. In addition, the DMS user must have the necessary permissions (such as `db_owner` or `sysadmin` role) to access the transaction logs.

Adım Adım Çözüm

1
Export the SQL Server TDE certificate and its private key from the source SQL Server database.
Obtained the TDE certificate file and private key file.
AWS DMS requires these files to decrypt the transaction logs.
2
Import the certificate into the AWS DMS certificate store using the AWS DMS console or the `aws dms import-certificate` CLI command.
A certificate resource is created in AWS DMS and assigned an Amazon Resource Name (ARN).
This registers the decryption key within the DMS service catalog so it can be associated with endpoints.
3
Configure the AWS DMS source database endpoint, referencing the imported certificate ARN, and verify that the database user used by DMS has `db_owner` or `sysadmin` permissions.
The source endpoint is associated with the decryption keys and the DMS task starts replication.
This allows the DMS replication instance to decrypt and read the transaction logs on the fly during the CDC phase.

Anahtar Kavram

AWS DMS CDC replication from a TDE-encrypted Microsoft SQL Server source requires importing the TDE certificate and private key into the AWS DMS certificate store and associating it with the source endpoint.
Bu soruyu puanla

Konular

Database Migration and Schema Conversion using DMS and SCT

Bu konudan daha fazla soru