Question #587
A financial institution operates a mission-critical monolithic application hosted on an Amazon EC2 instance running Amazon Linux 2. The compliance team mandates daily backups of the encrypted Amazon EBS volume data to an Amazon S3 bucket. The operations team lacks SSH access to the instance and cannot disrupt the application's availability.
Which solution satisfies these requirements?
Attach an IAM role with Amazon S3 write permissions to the instance. Use AWS Systems Manager Session Manager to access the instance and execute commands to transfer data to Amazon S3.
Create an Amazon Machine Image (AMI) of the instance without rebooting. Launch a new EC2 instance from the AMI, attach an IAM role with S3 permissions, and copy the data to Amazon S3.
Use Amazon Data Lifecycle Manager (DLM) to automate EBS snapshot creation. Configure a Lambda function to copy snapshot data to Amazon S3.
Stop the instance, create an AMI, launch a new instance from the AMI with an IAM role for S3 access, and run commands to copy data to Amazon S3.
Explanation
Option A satisfies all requirements:
- No SSH Access: AWS Systems Manager Session Manager allows command execution without SSH, complying with the lack of SSH access.
- IAM Role: Attaching an IAM role with S3 write permissions enables secure data transfer to S3.
- No Downtime: The solution does not require stopping/restarting the instance, ensuring application availability.
- Daily Backups: Commands can be automated via SSM Run Command or Maintenance Windows for daily execution.
Other options fail due to:
- B: Creating AMIs and launching instances is inefficient for daily backups and introduces complexity.
- C: EBS snapshots are stored in S3 but not as accessible objects; Lambda cannot easily process snapshots.
- D: Stopping the instance causes downtime, violating availability requirements.
Key Points: Use SSM for non-SSH access, IAM roles for permissions, and avoid downtime for mission-critical apps.
Answer
The correct answer is: A