AWS Certified SysOps Administrator – Associate — Question 173

A SysOps administrator is building a process for sharing Amazon RDS database snapshots between different accounts associated with different business units within the same company. All data must be encrypted at rest.

How should the administrator implement this process?

Answer options

• A. Write a script to download the encrypted snapshot, decrypt it using the AWS KMS encryption key used to encrypt the snapshot, then create a new volume in each account.
• B. Update the key policy to grant permission to the AWS KMS encryption key used to encrypt the snapshot with all relevant accounts, then share the snapshot with those accounts.
• C. Create an Amazon EC2 instance based on the snapshot, then save the instance's Amazon EBS volume as a snapshot and share it with the other accounts. Require each account owner to create a new volume from that snapshot and encrypt it.
• D. Create a new unencrypted RDS instance from the encrypted snapshot, connect to the instance using SSH/RDP, export the database contents into a file, then share this file with the other accounts.

Correct answer: B

Explanation

Option B is correct because updating the key policy to grant permission to the AWS KMS key allows other accounts to access the encrypted snapshot directly without the need for decryption or creating new volumes. The other options involve unnecessary steps or methods that do not meet the requirement of keeping data encrypted at rest, such as downloading and decrypting the snapshot (A), or exporting data to an unencrypted format (D).