An organization needs to migrate 150\text{ TB} of unstructured media files from an on-prem… — AWS Certified Solutions Architect - Professional

An organization needs to migrate $150\text{ TB}$ of unstructured media files from an on-premises SFTP server to an Amazon S3 bucket located in a separate, newly created AWS account. The organization has a dedicated $100\text{ Mbps}$ internet connection available for this migration, and the entire transfer must be completed within $21$ days. Active clients must continue to upload new files to the SFTP service during the migration, and the migration must not require client-side configuration or hostname changes. All migrated data must be encrypted at rest in the target S3 bucket using AWS Key Management Service (AWS KMS). Which strategy should a solutions architect recommend to meet these requirements?

A
Deploy AWS DataSync agents on-premises to transfer the $150\text{ TB}$ of historical data directly over the $100\text{ Mbps}$ internet connection to the destination Amazon S3 bucket. Create an AWS Transfer Family SFTP endpoint in the target account, and associate it with the S3 bucket. Update the public DNS record of the SFTP hostname to point to the Transfer Family endpoint.
B
Order two AWS Snowball Edge Storage Optimized devices to transfer the $150\text{ TB}$ of historical data. Configure the destination Amazon S3 bucket to use the default AWS-managed KMS key (`aws/s3`) for encryption. Set up AWS Transfer Family in the target account, grant the SFTP service role cross-account access to the bucket, and update the DNS record to point to the new Transfer Family endpoint.
Order two AWS Snowball Edge Storage Optimized devices to transfer the $150\text{ TB}$ of historical data. Create an AWS Customer Managed Key (CMK) in the target account, configure its key policy to allow cross-account access, and encrypt the destination Amazon S3 bucket with it. Create an AWS Transfer Family SFTP endpoint associated with the S3 bucket, and update the DNS record to point to the Transfer Family endpoint.Cevap
D
Order two AWS Snowball Edge Storage Optimized devices. Establish an AWS Transit Gateway VPN connection over the $100\text{ Mbps}$ internet connection. Deploy AWS DataSync agents to mount the Snowball Edge devices on-premises and sync the data over the VPN to S3, using Transit Gateway for cross-account routing. Associate AWS Transfer Family with the S3 bucket and update the DNS record.

Cevap

Order two AWS Snowball Edge Storage Optimized devices to transfer the historical data, encrypt the destination Amazon S3 bucket with a Customer Managed Key (CMK) configured for cross-account access, and deploy an AWS Transfer Family SFTP endpoint to handle client uploads using the existing hostname via a DNS update.

The correct strategy uses AWS Snowball Edge Storage Optimized devices for the bulk migration because transferring

150\text{ TB}

over a

100\text{ Mbps}

connection would take approximately

139

days, violating the

21

-day timeline. Cross-account access to the target Amazon S3 bucket requires encrypting the bucket with an AWS KMS Customer Managed Key (CMK), as the default AWS-managed KMS key (`aws/s3`) cannot be shared across accounts or have its key policy modified. AWS Transfer Family hosting the SFTP endpoint allows clients to connect using the same hostname via a DNS update, ensuring no client-side changes are required.

Adım Adım Çözüm

Calculate network transfer time to determine if online migration is possible.

Transferring

150\text{ TB}

over a

100\text{ Mbps}

link takes

\approx 139

days, which is far greater than the

21

-day migration window. Therefore, an offline migration using AWS Snowball Edge is required.

Ensures that the timeline constraint is verified before selecting the data transfer mechanism.

Evaluate KMS encryption requirements for cross-account data transfer.

AWS-managed KMS keys like `aws/s3` cannot have their key policies edited and cannot be shared across accounts. A Customer Managed Key (CMK) must be created in the target account to allow the cross-account role/user to write and decrypt data.

Ensures compliance and security policies are met while allowing cross-account ingestion.

Configure AWS Transfer Family and DNS routing to allow continuous uploads.

Deploy an AWS Transfer Family SFTP server endpoint associated with the S3 bucket in the target account. Update the DNS CNAME record of the SFTP domain to resolve to the new endpoint, preserving the hostname for clients.

Allows seamless cutover of client application uploads without requiring configuration changes on the client side.

Anahtar Kavram

Selecting the optimal hybrid data transfer service based on bandwidth constraints, cross-account security limitations of KMS keys, and endpoint protocol migration using AWS Transfer Family.

Tahmini Süre:2m 0s

Soru

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Konular

Bu konudan daha fazla soru