SAP-C02 Question 116
Single answerYou are a Solutions Architect designing a multi-account AWS environment for a large organization. Development, staging, and production environments are set up in separate AWS accounts. The organization wants to share specific Amazon RDS databases from the production account with the staging and development accounts for testing purposes. The solution must ensure minimal administrative overhead and adhere to the principle of least privilege. What is the best approach to achieve this?
- A
Use AWS Resource Access Manager (RAM) to share the Amazon RDS database snapshots with the staging and development accounts.
- B
Export the database to an Amazon S3 bucket in the production account, and grant staging and development accounts access to the bucket.
- C
Configure cross-account IAM roles in the production account to allow staging and development accounts to directly access the Amazon RDS instance.
- D
Create an Amazon RDS read replica in the production account and enable cross-account access for staging and development accounts.
Show answer and explanation
Correct answer: A
Explanation
AWS Resource Access Manager (RAM) is the recommended service for securely sharing specific resources like Amazon RDS database snapshots across AWS accounts. This approach avoids the need for duplicating resources or managing complex access mechanisms, while adhering to the principles of least privilege and minimizing administrative overhead.
- A. Correct.
Using AWS RAM to share Amazon RDS database snapshots is the optimal solution because it allows cross-account sharing of specific resources without the need for additional data transfer or creating new resources. This approach adheres to the principle of least privilege and minimizes administrative overhead.
- B. Incorrect.
Exporting the database to S3 requires additional steps, such as exporting data and managing permissions for the S3 bucket. This method adds unnecessary complexity and does not align with the principle of least privilege.
- C. Incorrect.
Configuring cross-account IAM roles for direct RDS access is not a valid option because Amazon RDS does not natively support cross-account instance-level access. This approach is not feasible.
- D. Incorrect.
Creating a read replica and enabling cross-account access is not supported by Amazon RDS. Additionally, it would increase administrative overhead and costs compared to using AWS RAM.