SOA-C03 · Question #124
A CloudOps engineer wants to share a copy of a production database with a migration account. The production database is hosted on an Amazon RDS DB instance and is encrypted at rest with an AWS Key…
The correct answer is A. Take a snapshot of the RDS DB instance in the production account. Amend the KMS key policy. Encrypted RDS snapshots can be shared across accounts only if the KMS key that encrypts them allows the target account to use the key. The CloudOps engineer should (1) take a snapshot of the encrypted RDS instance, (2) update the production-rds-key KMS key policy to grant the…
Question
A CloudOps engineer wants to share a copy of a production database with a migration account. The production database is hosted on an Amazon RDS DB instance and is encrypted at rest with an AWS Key Management Service (AWS KMS) key that has an alias of production-rds-key. What must the CloudOps engineer do to meet these requirements with the LEAST administrative overhead?
Options
- ATake a snapshot of the RDS DB instance in the production account. Amend the KMS key policy
- BCreate an RDS read replica in the migration account. Configure the KMS key policy to replicate
- CTake a snapshot of the RDS DB instance in the production account. Share the snapshot with the
- DUse native database toolsets to export the RDS DB instance to Amazon S3. Create an S3 bucket
How the community answered
(48 responses)- A71% (34)
- B19% (9)
- C6% (3)
- D4% (2)
Explanation
Encrypted RDS snapshots can be shared across accounts only if the KMS key that encrypts them allows the target account to use the key. The CloudOps engineer should (1) take a snapshot of the encrypted RDS instance, (2) update the production-rds-key KMS key policy to grant the migration account access, and then (3) share the snapshot with the migration account. This is the simplest, fully managed approach with the least administrative overhead.
Topics
Community Discussion
No community discussion yet for this question.