AWS Certified SysOps Administrator – Associate (legacy) — Question 573

A SysOps Administrator is building a process for sharing Amazon RDS database snapshots between different accounts associated with different business units within the same company. All data must be encrypted at rest.
How should the Administrator implement this process?

Answer options

• A. Write a script to download the encrypted snapshot, decrypt it using the AWS KMS encryption key used to encrypt the snapshot, then create a new volume in each account.
• B. Update the key policy to grant permission to the AWS KMS encryption key used to encrypt the snapshot with all relevant accounts, then share the snapshot with those accounts.
• C. Create an Amazon EC2 instance based on the snapshot, then save the instance's Amazon EBS volume as a snapshot and share it with the other accounts. Require each account owner to create a new volume from that snapshot and encrypt it.
• D. Create a new unencrypted RDS instance from the encrypted snapshot, connect to the instance using SSH/RDP, export the database contents into a file, then share this file with the other accounts.

Correct answer: B

Explanation

To share an encrypted Amazon RDS snapshot with other AWS accounts, you must share the custom AWS KMS key used to encrypt the snapshot by updating its key policy to include the target accounts, then share the snapshot itself. Other options are incorrect because you cannot directly download RDS snapshots, you cannot launch an EC2 instance directly from an RDS snapshot, and exporting data to an unencrypted file violates the requirement to keep all data encrypted at rest.