How to Encrypt Cross-Region EBS Backups with Least Overhead?
A company is expanding globally and needs to back up data on Amazon EBS volumes to a different AWS Region. Most of the EBS volumes that store the data are encrypted, but some of the EBS volumes are unencrypted. The company needs the backup data from all the EBS volumes to be encrypted. Which solution will meet these requirements with the LEAST management overhead?
Community Insight
This question tests least-overhead automation for encrypted cross-Region EBS backups, and the trap is choosing a custom Lambda workflow or a manual copy with Encrypted=False.
Cross-Region EBS snapshot backups must be encrypted even when some source volumes are unencrypted. This page establishes that an Amazon Data Lifecycle Manager lifecycle policy with KMS-encrypted cross-Region copies is the least-overhead solution.
The most common wrong answer is D, a Lambda function, because it sounds flexible, but it adds code, IAM, scheduling, and error-handling management that DLM eliminates.
Community Discussion (1 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Option A is correct because Amazon Data Lifecycle Manager is the managed EBS snapshot lifecycle service designed to create and copy snapshots on a schedule. A DLM lifecycle policy can create EBS volume snapshots and enable cross-Region backups, and the cross-Region copy action can specify encryption with a KMS key in the destination Region. Because DLM handles encrypted and unencrypted source volumes through the same policy, it satisfies the requirement that all backup data be encrypted. It also minimizes operational work: no custom code, no manual snapshot orchestration, and no separate cleanup process.Why the Other Options Are Wrong
Option B is manual and explicitly sets Encrypted to False when copying the snapshot, which leaves the destination backup unencrypted and fails the core requirement. Option C incorrectly assumes EBS snapshots can be copied directly into an S3 bucket and then protected by S3 Cross-Region Replication; S3 CRR does not encrypt EBS snapshot backups or provide the required cross-Region EBS snapshot copy. Option D uses a custom Lambda function to create, encrypt, and copy snapshots, which adds code maintenance, IAM permissions, scheduling, monitoring, and failure handling compared with a DLM lifecycle policy. A point-in-time snapshot also does not provide the ongoing backup workflow that DLM manages.Community Comment Notes
The only visible community input is from Bad_Mat, who selected option A. That aligns with the DLM-based answer and does not introduce any conflicting technical argument. Because there is no vote distribution or substantive debate in the comments, the decision rests on the AWS documentation and the least-overhead requirement.Official Reference
Exam Strategy
When the question asks for the least management overhead for recurring EBS backups and cross-Region copies, prefer the managed DLM lifecycle policy over custom Lambda automation. Also check the encryption direction: cross-Region snapshot copies must be encrypted with a KMS key in the destination Region, not left with Encrypted=False.
Frequently Asked Questions
Why is Encrypted=False in option B incorrect for cross-Region copies?
Setting Encrypted=False leaves the destination snapshot unencrypted; to encrypt a copy, the copy operation must specify Encrypted=True and a KMS key in the destination Region.
Why not use an AWS Lambda function instead of Amazon DLM for EBS snapshots?
A custom Lambda workflow requires maintaining code, IAM permissions, scheduling, and error handling, while DLM is a managed service built for snapshot lifecycle and cross-Region copy.
Related Analysis
Practice All SOA-C03 Questions
Access 100 questions with complete answers and detailed explanations.
View Full SOA-C03 Practice Test →