A SysOps Administrator is configuring AWS Elastic Disaster Recovery (AWS DRS) to replicate on-premises virtual machines to AWS. The administrator faces two challenges: the replication servers in the staging area cannot communicate with the AWS DRS service, and subsequent attempts to launch drill instances fail due to permission authorization errors.
Which TWO actions should the administrator take to resolve these issues? (Select TWO.)
- Ensure the staging area subnet has a route to the AWS DRS service endpoints via a NAT gateway or through Interface VPC endpoints (AWS PrivateLink).Cevap
- Grant the iam:PassRole permission to the IAM identity initiating the drill launch, allowing it to pass the required execution roles to the recovery instances.Cevap
- CGrant the sts:AssumeRole permission in the IAM user policy of the administrator to allow them to directly assume the replication server EC2 instance roles during launch.
- DCreate a Gateway VPC endpoint for AWS DRS and associate it with the route table of the staging area subnet to enable private replication path routing.
- EConfigure an Amazon Route 53 active-active failover routing policy to automatically redirect replication agent traffic to the staging area VPC.
Cevap
The correct actions are: ensuring the staging area subnet has a route to the AWS DRS service endpoints via a NAT gateway or Interface VPC endpoints, and granting the iam:PassRole permission to the IAM identity initiating the drill launch.
AWS DRS replication servers in the staging VPC require communication with the AWS DRS control plane, which can be accomplished either publicly via a NAT gateway or privately using Interface VPC endpoints. During a drill or recovery launch, the initiating IAM user or role must possess the iam:PassRole permission to pass the required execution and helper instance profile roles to the target recovery EC2 instances.
Adım Adım Çözüm
Anahtar Kavram
AWS Elastic Disaster Recovery (AWS DRS) staging network connectivity and IAM PassRole launch permissions