Exam AWS Certified Solutions Architect - Associate SAA-C02 topic 1 question 250 discussion

I cleared the exam today on 26-Jan, This question was there in the exam, I marked D i.e. Share the encrypted snapshot and give access on KMS

A. The question says the auditor needs its own copy of the database. A read replica won't do this request. B. We can't have direct access to the bucket in S3. C. Sounds a lot of work, I doubt, someone is going to be auditing from text files. D. Sounds reasonable. Making an encrypted snapshot, the auditor, will have it's own copy of the database.

The correct Option is D.

Should be D: You can share DB snapshots that have been encrypted "at rest" using the AES-256 encryption algorithm, as described in Encrypting Amazon RDS resources. To do this, take the following steps: Share the AWS KMS key that was used to encrypt the snapshot with any accounts that you want to be able to access the snapshot. You can share KMS keys with another AWS account by adding the other account to the KMS key policy. For details on updating a key policy, see Key policies in the AWS KMS Developer Guide. For an example of creating a key policy, see Allowing access to an AWS KMS key later in this topic. Use the AWS Management Console, AWS CLI, or Amazon RDS API to share the encrypted snapshot with the other accounts.

D is suitable for the "secure manner" in question. "Sharing encrypted snapshots" and "Allowing access to an AWS KMS key" https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_ShareSnapshot.html

Sharing encrypted snapshots You can share DB snapshots that have been encrypted "at rest" using the AES-256 encryption algorithm, as described in Encrypting Amazon RDS resources. To do this, take the following steps: Share the AWS KMS key that was used to encrypt the snapshot with any accounts that you want to be able to access the snapshot. D You can share KMS keys with another AWS account by adding the other account to the KMS key policy.

Question is How should the company "securely" share the database with the auditor?. Sharing unencrypted copy is not secure at all!

"allow access to the AWS Key Management Service (AWS KMS) encryption key." - not sure if this is best practice.

Own Copy Of Database AWS Account Secure

- A is wrong. Auditor needs a static copy of the DB - B is wrong. It is less secure than D because the snapshot is unencrypted - C is wrong. It is less secure than D because the snapshot is unencrypted - D is correct. Sharing of KMS CMK can be done by attaching an IAM policy on the auditor's account that grants access to the key - https://aws.amazon.com/premiumsupport/knowledge-center/share-kms-account/

Confused between B and D as both matches but D although is more secure but can we share the KMS keys with another AWS account?

was confused between B & D but upon reading again, question says "The auditor has its own Amazon Web Services (AWS) account and demands a copy of the database.", B talks about granting access to the object so D seems to be the right option.

Usually an Auditor only performs data review for forensic analysis, not need to modify the data, so not sure why to give him an encrypted snapshot of the DB... a read replica can comply with the requirement.. and it would be secure since the access would be done by IAM permissions to his AWS account...

https://www.youtube.com/watch?v=gFkguN0y_ho I guess D

Key points are: * auditor has its own AWS account and requires its own copy of the database * securely share the database with the auditor A is out because the auditor is not using its own copy B matches both requirements C is not direct and the auditor will not use its own account D Using B you don't need to encrypt the snapshot and it's less specific than B (how to share the snapshot ? how to give access to KMS in the company's account ?) I go with B

Correct Answer : D Create an encrypted snapshot of the database, share the snapshot, and allow access to the AWS Key Management Service (AWS KMS) encryption key You can share the AWS Key Management Service (AWS KMS) customer master key (CMK) that was used to encrypt the snapshot with any accounts that you want to be able to access the snapshot. You can share AWS KMS CMKs with another AWS account by adding the other account to the AWS KMS key policy. Making an encrypted snapshot of the database will give the auditor a copy of the database, as required for the given use case.

https://aws.amazon.com/premiumsupport/knowledge-center/encrypt-rds-snapshots/