Q37 — AWS SAA-C03 第3章

第 37/65 题 | ← 返回第3章

Q167.一家公司将机密数据存储在 ap-southeast-3 区域的 Amazon Aurora PostgreSQL 数据库中.该数据库使用 AWS Key Management Service (AWS KMS) 客户管理的密钥进行加密.该公司最近被收购，必须与收购公司在 ap-southeast-3 中的 AWS 账户安全地共享数据库备份.解决方案架构师应该怎么做才能满足这些要求?

正确答案: B. 创建数据库快照.将收购公司的 AWS 账户添加到 KMS 密钥策略中.与收购公司的 AWS 账户共享快照.

解析

To meet the requirement of securely sharing a backup of an Amazon Aurora PostgreSQL database with the acquiring company's AWS account in the ap-southeast-3 Region, which is encrypted with an AWS KMS customer managed key, a solutions architect should create a database snapshot and add the acquiring company's AWS account to the KMS key policy. The snapshot can then be shared with the acquiring company's AWS account. Therefore, option B is the correct answer.Option A suggests copying the snapshot to a new unencrypted snapshot, which is not recommended for maintaining security.Option C suggests creating a database snapshot that uses a different AWS managed KMS key and adding the acquiring company's AWS account to the KMS key alias. This approach could work, but it requires more manual configuration and may not maintain the original key management strategy.Option D suggests downloading the database snapshot and uploading it to an S3 bucket, updating the bucket policy to allow access from the acquiring company's AWS account. While this approach could work, it requires more manual configuration and may not maintain the same level of security as using KMS encryption.By creating a database snapshot and adding the acquiring company's AWS account to the KMS key policy, the acquiring company can access the snapshot while maintaining the same level of security as the original database. This approach provides a secure, scalable, and reliable solution for sharing confidential data between AWS accounts.为了满足与收购公司在ap-东南-3地区的AWS帐户安全地共享Amazon Aurora PostgreSQL数据库备份的需求，该备份使用AWS KMS客户管理的密钥进行加密，解决方案架构师应该创建数据库快照并将收购公司的AWS帐户添加到KMS密钥策略中。然后，快照可以与收购公司的AWS账户共享。因此，选项B是正确答案。选项A建议将快照复制到新的未加密快照，出于安全考虑不建议这样做。选项C建议创建使用不同AWS管理的KMS密钥的数据库快照，并将收购公司的AWS帐户添加到KMS密钥别名中。这种方法可以工作，但它需要更多的手动配置，并且可能无法维护原始的密钥管理策略。选项D建议下载数据库快照并将其上传到S3存储桶，更新存储桶策略以允许从收购公司的AWS帐户访问。虽然这种方法可以工作，但它需要更多的手动配置，并且可能无法保持与使用KMS加密相同的安全级别。通过创建数据库快照并将收购公司的AWS帐户添加到KMS密钥策略，收购公司可以访问快照，同时保持与原始数据库相同的安全级别。此方法为在AWS帐户之间共享机密数据提供了安全、可扩展且可靠的解决方案。