AWS Certified Security – SpecialtyDomain 5: Data ProtectionEasy
A global financial institution is expanding its operations into a new country with strict data residency laws. All customer data for this region must be stored and processed exclusively within the country's borders. The institution plans to use Amazon RDS for PostgreSQL to store customer transaction data and requires that all backups and snapshots also adhere to these residency requirements. Which solution ensures both the primary database and its backups remain within the specified AWS Region?
- AProvision the RDS instance in any AWS Region and rely on AWS Global Accelerator to route traffic locally.
- BImplement a custom script to manually export data from RDS to an S3 bucket in a different AWS Region.
- CUtilize AWS Backup to create cross-Region backups of the RDS instance to a designated region outside the country.
- DConfigure Amazon RDS with Multi-AZ deployment within the required AWS Region and enable automated backups.
Show answer & explanationAnswer & explanation
Correct answer: D. Configure Amazon RDS with Multi-AZ deployment within the required AWS Region and enable automated backups.
A Multi-AZ deployment within a single AWS Region, combined with automated backups, ensures that all data, including backups and snapshots, remains within that specific Region, satisfying data residency requirements.
Why the other options are wrong
- A. AWS Global Accelerator routes traffic but does not control data residency; the underlying RDS instance location determines data residency.
- B. Manually exporting data to an S3 bucket in a different AWS Region would violate data residency requirements.
- C. Cross-Region backups explicitly violate data residency requirements by storing data outside the specified country's borders.
RDS Data Residency
Ensuring that Amazon RDS database instances and all associated data, including backups and snapshots, are stored and processed exclusively within a specific geographic AWS Region to comply with regulatory requirements.
- Data residency is enforced by selecting the appropriate AWS Region during resource provisioning.
- Multi-AZ deployments keep all data within the chosen Region.
- Automated backups and manual snapshots are also confined to the Region of the RDS instance.
Memory trick: Regional Residency Rules Restrict Remote Resources.