Examkin

Soru

Zorluk: Çok zorDatabase and Storage Strategy

A digital banking startup is designing a new multi-region, multi-tenant core ledger system. The system consists of two primary data tiers:

1. Ledger Database: A relational Online Transaction Processing (OLTP) workload requiring sub-20 ms20\text{ ms} write latencies and the ability to dynamically scale read operations to handle heavy, unpredictable reporting queries during fiscal closing. In the primary AWS Region, the database must maintain an RPO of 00 and an RTO of less than 30 seconds30\text{ seconds}. For cross-region disaster recovery, the database must achieve an RPO of less than 1 minute1\text{ minute} and an RTO of less than 15 minutes15\text{ minutes}.
2. Transaction Artifacts: An object storage tier hosting signed PDF transaction records. Artifacts are generated by containerized applications running in developer accounts and uploaded to a central Amazon S3 bucket in a dedicated Archive account. All artifacts must be encrypted at rest. The Archive account security team must retain administrative control over the encryption keys, but must grant the developer accounts the ability to encrypt artifacts during the upload process.

Which storage and database architecture meets these requirements with the lowest operational complexity?

  1. A
    Deploy Amazon RDS for PostgreSQL in a Multi-AZ configuration in the primary region. Offload the reporting queries to the passive standby instance in the secondary Availability Zone to scale reads. Establish cross-region disaster recovery by provisioning a cross-region read replica. In the Archive account, create the Amazon S3 bucket and a Customer Managed Key (CMK) in AWS KMS, updating the key policy to grant the developer accounts' IAM roles permissions to use the key.
  2. Deploy an Amazon Aurora PostgreSQL Global Database. In the primary region, configure Aurora Replicas with Auto Scaling to scale read capacity. Replicate data asynchronously to the secondary region. In the Archive account, create the Amazon S3 bucket and a Customer Managed Key (CMK) in AWS KMS. Configure the key policy to allow the developer accounts' IAM roles permissions to use the key, and configure the S3 bucket policy to allow cross-account write access requiring key encryption.Cevap
  3. C
    Deploy Amazon Aurora PostgreSQL in the primary region, configuring Aurora Replicas with Auto Scaling for read operations. To support cross-region disaster recovery, create an AWS Backup plan that copies database snapshots to the secondary region every 12 hours12\text{ hours}, and manually restore the database in the event of a disaster. In the Archive account, create the Amazon S3 bucket and a Customer Managed Key (CMK) in AWS KMS, updating the key policy to grant the developer accounts' IAM roles permissions to use the key.
  4. D
    Deploy an Amazon Aurora PostgreSQL Global Database, configuring Aurora Replicas with Auto Scaling in the primary region for read scaling. In the Archive account, create the Amazon S3 bucket configured with default encryption using the AWS-managed KMS key for Amazon S3 (aws/s3). Configure the Archive S3 bucket policy to allow the developer accounts cross-account access and permit them to use the aws/s3 key to encrypt uploads.

Cevap

Deploy an Amazon Aurora PostgreSQL Global Database with Aurora Replicas and Auto Scaling for read scaling, and use a Customer Managed Key in AWS KMS to encrypt the cross-account Amazon S3 uploads.
The correct design uses Amazon Aurora PostgreSQL Global Database because it satisfies the primary region requirements (RPO of 0, RTO under 30 seconds via storage replication) and cross-region requirements (RPO under 1 minute, RTO under 15 minutes via Global Database promotion). Furthermore, a Customer Managed Key (CMK) is used for S3 bucket encryption in the Archive account because it can be shared with developer accounts by updating its key policy, allowing cross-account uploads.

Adım Adım Çözüm

1
Analyze database HA and read-scaling requirements in the primary region.
Amazon Aurora replicates data across three Availability Zones at the storage level, which guarantees an RPO of 0 and failover to a replica in under 30 seconds (RTO). Read capacity is horizontally scalable using Aurora Replicas.
This guarantees that local database failover meets the strict RPO and RTO constraints while supporting auto-scaled read capacity.
2
Analyze database cross-region disaster recovery requirements.
Amazon Aurora Global Database uses dedicated storage-level replication with lag typically under 1 second (meeting the RPO of less than 1 minute) and can be promoted to write mode in less than 15 minutes (meeting the RTO).
Asynchronous logical or snapshot-based solutions fail to meet the tight RPO and RTO constraints of this scenario.
3
Analyze artifact storage encryption and cross-account access rules.
Cross-account access to KMS-encrypted S3 buckets requires a Customer Managed Key (CMK) because AWS-managed keys (like aws/s3) cannot have their policies modified to delegate access to other accounts.
Only Customer Managed Keys can be shared across account boundaries via key policies.

Anahtar Kavram

Multi-region database replication and cross-account S3 key delegation in AWS
Bu soruyu puanla

Konular

Database and Storage Strategy

Bu konudan daha fazla soru