A SysOps Administrator is building a process for sharing Amazon RDS database snapshots between different accounts associated with different business units with the same company. All data must be encrypted at rest. How should the Administrator implement this process?
A) Write a script to download the encrypted snapshot, decrypt if using the AWS KMS encryption key used to encrypt the snapshot, then create a new volume in each account.
B) Update the key policy to grant permission to the AWS KMS encryption key used to encrypt the snapshot with all relevant accounts, then share the snapshot with those accounts.
C) Create an Amazon EC2 instance based on the snapshot, then save the instance's Amazon EBS volume as a snapshot and share it with the other accounts. Require each account owner to create a new volume from that snapshot and encrypt it.
D) Create a new unencrypted RDS instance from the encrypted snapshot, connect to the instance using SSH/RDP. export the database contents into a file, then share this file with the other accounts.

Question

Quizplus · Accepted Answer

The correct approach is to update the key policy to allow access to the AWS KMS encryption key for the relevant accounts and then share the encrypted snapshot. This maintains encryption at rest and allows cross-account access.

A SysOps Administrator Is Building a Process for Sharing Amazon