The company wants backups to be stored in an isolated central account designed for WORM storage. With AWS Organizations, AWS Backup supports centralized, cross-account backup management through delegated administration, backup policies, and cross-account backup vault usage. This provides the least operational overhead and scales to dozens of databases.
A key constraint is encryption. The databases are encrypted with the default RDS AWS KMS key. AWS-managed KMS keys (including the default RDS KMS key) are not customer-managed and generally cannot be shared across accounts for cross-account snapshot copy and cross-account backup workflows that require key sharing and explicit grants. For cross-account backup copies, the source backups must be encrypted with a customer managed KMS key that can be shared (via key policy and grants) with the destination account. Therefore, the company must move away from using the default RDS AWS-managed key for encryption of snapshots that will be copied across accounts.
Option A uses the correct managed approach: enable trusted access and backup policies in Organizations, make the central account the delegated administrator, and use AWS Backup to manage cross-account backups into a central backup vault. It also correctly introduces a customer managed KMS key in the central account for the backup vault and shares that key with the production account. Because the existing databases are encrypted with the default RDS AWS-managed key, option A includes the necessary remediation step: restore (or otherwise recreate) the databases so they are encrypted with the shared customer managed KMS key, enabling future backups and copies to be encrypted with a shareable key and stored in the central vault.
Option B is not workable because it requires “sharing the default RDS KMS key” with another account and using it for the central vault. AWS-managed keys are not shared and are not controlled by customers in a way that supports this cross-account backup model. Therefore, this option fails the encryption requirement.
Option C and option D rely on decrypting snapshots, copying them as unencrypted, and then re-encrypting. This is not a valid or safe operational pattern for RDS automated backups at scale, and it conflicts with typical constraints around snapshot encryption transitions. It also introduces substantial custom automation and operational overhead, and it undermines the objective of a controlled WORM backup account by manipulating encryption state through custom code. Additionally, “decrypting snapshots” is not how encrypted RDS snapshots are typically handled; encrypted snapshots remain encrypted and are copied re-encrypted with a different KMS key that the destination can use, which requires a customer managed key and proper permissions.
Therefore, the successful and scalable solution is to centralize backups with AWS Backup and ensure the databases are encrypted with a customer managed KMS key that can be shared cross-account, as described in option A.
[References:, AWS documentation on AWS Backup centralized management with AWS Organizations, including delegated administrator and backup policies for cross-account governance., AWS documentation on cross-account backup and snapshot copy requirements for encryption, including the need to use AWS KMS customer managed keys for cross-account sharing and re-encryption., AWS guidance that AWS-managed KMS keys (service-managed default keys) are not shareable across accounts for these cross-account encryption and copy workflows., , , , ]
