Examkin

Soru

Zorluk: Çok zorBackup and Restore Management

A SysOps administrator is tasked with establishing a cross-account, cross-Region backup solution for a production Amazon RDS for PostgreSQL database. The database resides in Account AAccount\ A (source) in the us-east-1\text{us-east-1} Region. The compliance team requires that weekly backups of this database be copied to Account BAccount\ B (destination) in the us-west-2\text{us-west-2} Region, and that all backups remain encrypted.

The administrator configures an AWS Backup plan in Account AAccount\ A to perform weekly backups and copy them to a destination backup vault in Account BAccount\ B in us-west-2\text{us-west-2}. The copy jobs fail immediately with an access denied error. Both the source and destination backup vaults are currently encrypted using default AWS managed KMS keys.

What is the correct configuration change required to resolve this issue and successfully copy the backups?

  1. A
    Export the RDS snapshots to an Amazon S3 bucket, configure Amazon S3 Cross-Region Replication (CRR) to sync the files to a bucket in Account B in us-west-2, and disable S3 Versioning on both buckets to minimize storage costs.
  2. B
    Modify the default AWS-managed KMS key policy in Account A to grant cross-account access to Account B, and associate an IAM policy with the AWS Backup service role in Account A to delegate the decryption rights.
  3. Create a customer managed KMS key in Account A to encrypt the source backup vault. Update the backup vault access policy in the destination vault in Account B to allow the backup:CopyIntoBackupVault action for the AWS Backup service role from Account A.Cevap
  4. D
    Configure a cross-Region Read Replica of the RDS PostgreSQL database in Account B in us-west-2, disable automated backups on the primary instance in Account A, and enable automated backups on the Read Replica to handle local recovery.

Cevap

Create a customer managed KMS key in the source account to encrypt the source backup vault, and update the vault access policy in the destination account's backup vault to permit copy operations from the source service role.
AWS Backup cross-account copying cannot proceed when the source backup vault is encrypted with the default AWS-managed KMS key (aws/backup) because these keys cannot be shared across accounts. A customer managed KMS key must be created and configured in the source account to encrypt the source vault. Furthermore, backup vaults are private by default; the destination vault in the destination account must have a vault access policy attached that explicitly permits the `backup:CopyIntoBackupVault` action for the AWS Backup service role in the source account.

Adım Adım Çözüm

1
Evaluate the encryption limitations of AWS Backup cross-account copy operations.
Determine that AWS-managed KMS keys (e.g., default vault encryption keys) cannot be shared across accounts, meaning copy jobs will fail with Access Denied if the source vault uses one.
KMS key policies on default AWS-managed keys are immutable and restricted to the local account, forcing the use of a customer managed KMS key.
2
Re-encrypt the source backup vault in the source account using a customer managed KMS key.
The source vault is now encrypted with a key that can have its policy modified to allow cross-account access or delegated access via IAM roles.
A customer managed KMS key allows the AWS Backup service role to access the key during the copy and re-encryption phase.
3
Modify the destination backup vault's access policy in the destination account.
A policy is attached allowing the source account's AWS Backup service role permissions to execute `backup:CopyIntoBackupVault` on the destination vault.
By default, destination backup vaults reject external write attempts. An explicit vault access policy is required to allow incoming cross-account copies.

Anahtar Kavram

AWS Backup cross-account copy operations require customer managed KMS keys on the source vault and explicit cross-account write permissions in the destination vault access policy.
Tahmini Süre:3m 0s
Bu soruyu puanla

Konular

Backup and Restore Management

Bu konudan daha fazla soru