AWS Migration Services

Question 1

What is Migration Services used for?

Answer 1

Migration services consist of two main tools,

• Scheme conversion tool (DB and whare houses)
• Database migration services

Question 2

I need to convert my on-prem database schema to be compatible with Aurora, we are also changing the software, what tooling can I use?

Answer 2

Scheme conversion tool

Question 3

What are the supported sources for AWS Migration Service?

Answer 3

MySQL
Oracle
SQL Server
Db2 LUW
MarialDB
Sybase ASE
Azure SQL
Aurora
Mongo
Casandra
Netezza 
Greenplum
Teradaat
S3
Snowball edge
Vetica

Question 4

What is the supported destination for AWS Migration Service?

Answer 4

PostgreSQL
 MySQL
Amazon Aurors
Oracle
SQL Server
MariaDB
DynamoDB
Redshift
S3
Amazon ES
Kinesis

Question 5

I wnat to migrate my data wherehouse to RedShift, what tooling should I use?

Answer 5

AWS Migration Service

Question 6

I wnat to migrate NoSQL to SQL what is my best option?

Answer 6

AWS Migration Service

Question 7

I wnat to migrate SQL to NoSQL what is my best option?

Answer 7

AWS Migration Service

Question 8

I wnat to migrate NoSQL to NoSQL what is my best option?

Answer 8

AWS Migration Service

Question 9

Can I use AWS Migration Service for replication of the database?

Answer 9

Yes

Question 10

I wnat to save my DB to SQL, how cna I do this?

Answer 10

AWS Migration Service

Question 11

When using the Database migration services, is it a 100% fully managed services or is it allocation managed instances for replication?

Answer 11

It is deploying instances in your VPC for the replication. It sets up security groups and you can even have a MultiAZ varsion.

Question 12

According to the text, security in AWS is described using what model?

Answer 12

The Shared Responsibility Model.

Question 13

In the Shared Responsibility Model, what is AWS responsible for?

Answer 13

Security of the cloud: Protecting the infrastructure that runs AWS services.

Question 14

In the Shared Responsibility Model, what is the customer responsible for?

Answer 14

Security in the cloud: Configuring AWS services securely, determined by the service used, data sensitivity, organizational requirements, and applicable laws/regulations.

Question 15

What AWS service is used to assign permissions determining who can manage AWS DMS resources?

Answer 15

AWS Identity and Access Management (IAM).

Question 16

What kind of actions on AWS DMS resources can be controlled using IAM policies?

Answer 16

Creating, describing, modifying, and deleting resources (like replication instances, tasks, endpoints), tagging resources, and modifying security groups.

Question 17

Are specific IAM permissions required to interact with AWS DMS if signing in as an IAM user?

Answer 17

Yes, the text states AWS DMS requires appropriate permissions for IAM users.

Question 18

What security protocol does AWS DMS use for securing endpoint connections, incorporating Transport Layer Security (TLS)?

Answer 18

Secure Sockets Layer (SSL).

Question 19

Is the use of SSL/TLS for endpoint connections optional in AWS DMS according to this overview text?

Answer 19

The text implies it’s standard practice (‘AWS DMS uses Secure Sockets Layer (SSL)…’) but directs to another section for more details.

Question 20

What specific aspect of endpoint connections does SSL/TLS secure in AWS DMS?

Answer 20

The data in transit between the DMS replication instance and the source/target database endpoints.

Question 21

What AWS service does DMS use to manage encryption keys for securing its resources?

Answer 21

AWS Key Management Service (AWS KMS).

Question 22

What two primary things does AWS DMS encrypt using AWS KMS keys, according to the initial overview?

Answer 22

1. The storage used by the replication instance. 2. Endpoint connection information.

Question 23

For which specific target endpoints does DMS also use AWS KMS keys to encrypt data at rest?

Answer 23

Amazon S3 and Amazon Redshift target endpoints.

Question 24

What type of AWS KMS key does DMS use by default to encrypt replication instance storage?

Answer 24

A KMS key that is unique to your AWS account (often referred to as the default ‘aws/dms’ key).

Question 25

Can you view and manage the KMS key used by AWS DMS for replication instance encryption?

Answer 25

Yes, using the AWS KMS console.

Question 26

What are the options mentioned for the KMS key used for encrypting DMS replication instance storage?

Answer 26

1. The default KMS key (`aws/dms`). 2. A custom KMS key created by the user. 3. An existing KMS key already in the account.

Question 27

What specific requirement applies to any custom or existing AWS KMS key used with AWS DMS?

Answer 27

It *must* be a symmetric key.

Question 28

Does AWS DMS support the use of asymmetric KMS keys for encryption?

Answer 28

No, the text explicitly states asymmetric keys are not supported.

Question 29

When is the default KMS key (`aws/dms`) automatically created for DMS?

Answer 29

When you first launch a replication instance *if* you haven't selected a custom KMS key.

Question 30

What are the *only* specific KMS permissions needed for an IAM user if using the *default* `aws/dms` KMS key for migration?

Answer 30

`kms:ListAliases` and `kms:DescribeKey`.

Question 31

What is one way to grant the necessary permissions to an IAM user to use a *custom* KMS key with AWS DMS?

Answer 31

Add the IAM user account as a 'key administrator' or 'key user' for that specific custom KMS key via KMS policies.

Question 32

If not adding the IAM user as a key admin/user, what specific KMS actions must be added to the user's IAM policy to allow use of a *custom* KMS key with DMS?

Answer 32

`kms:ListAliases`, `kms:DescribeKey`, `kms:CreateGrant`, `kms:Encrypt`, `kms:ReEncrypt*` (on Resource: '*').

Question 33

Does AWS DMS support using KMS key aliases instead of full key ARNs/IDs?

Answer 33

Yes, the text confirms KMS key aliases are supported.

Question 34

What KMS key does AWS DMS use if you don't explicitly specify a KMS key identifier when creating a resource?

Answer 34

The default encryption key for AWS DMS in that specific AWS Region (`aws/dms`).

Question 35

Where can you manage the AWS KMS keys used for encrypting AWS DMS resources (e.g., create keys, define policies)?

Answer 35

In the AWS Key Management Service (AWS KMS) console.

Question 36

What AWS service integrates with KMS to allow auditing of KMS key usage, ensuring keys are used appropriately?

Answer 36

AWS CloudTrail.

Question 37

Can you create custom AWS KMS keys specifically for encrypting target data for Amazon Redshift endpoints when using AWS DMS?

Answer 37

Yes.

Question 38

Can you create custom AWS KMS keys specifically for encrypting target data for Amazon S3 target objects when using AWS DMS?

Answer 38

Yes.

Question 39

Can you change the AWS KMS encryption key associated with an AWS DMS resource *after* the resource has been created?

Answer 39

No, the text explicitly states you cannot change the encryption key after creation.

Question 40

What crucial step must be taken *before* creating AWS DMS resources regarding encryption?

Answer 40

You must determine your encryption key requirements beforehand, as the key cannot be changed later.

Question 41

Where are AWS DMS replication instances always created to ensure network access control?

Answer 41

Within a Virtual Private Cloud (VPC) based on the Amazon VPC service.

Question 42

What is a general network security rule regarding the DMS replication instance's security group?

Answer 42

It must have egress rules allowing traffic *out* on the database ports to the source and target endpoints.

Question 43

What is a general network security rule regarding the security groups or network ACLs of the source and target database endpoints?

Answer 43

They must have ingress rules allowing traffic *in* from the replication instance.

Question 44

How might an endpoint allow ingress from the replication instance, depending on the network configuration?

Answer 44

By allowing the replication instance's security group, its private IP address, its public IP address, or the NAT gateway's public IP address.

Question 45

In a configuration where all DMS components are in one VPC, how must the endpoint security groups be configured?

Answer 45

They must allow ingress on the database port *from* the replication instance (e.g., by allowing its security group or private IP).

Question 46

If a DMS replication instance uses a NAT gateway to reach an endpoint outside the VPC, what IP address must the endpoint's ingress rules allow?

Answer 46

The public IP address of the NAT gateway (not the replication instance's own IP).

Question 47

Does AWS DMS support using VPC endpoints for connectivity to non-RDBMS engines?

Answer 47

No, the text states DMS doesn't support VPC endpoints for non-RDBMS engines.

Question 48

What AWS service permissions are needed for an IAM role/user to view database migration logs generated by AWS DMS?

Answer 48

Appropriate Amazon CloudWatch Logs permissions.

Question 49

Where are AWS DMS task logs typically sent for viewing and monitoring?

Answer 49

Amazon CloudWatch Logs.

Question 50

What is required to access and read the logs generated by an AWS DMS replication task?

Answer 50

The IAM user or role needs permissions granted for CloudWatch Logs actions.

Question 51

Can you change the database password for a source or target endpoint while an AWS DMS task using it is actively running?

Answer 51

No, the text outlines a procedure that requires stopping the task first.

Question 52

What is the first step in the procedure described to change the database password for an endpoint used in an active DMS migration task?

Answer 52

Stop the DMS task that uses the endpoint.

Question 53

After stopping the DMS task and changing the database password using native database tools, what action must be taken within the AWS DMS console?

Answer 53

Modify the corresponding DMS endpoint configuration, entering the new password.

Question 54

What is the final step required to continue the migration after stopping the task, changing the DB password, and updating the DMS endpoint configuration?

Answer 54

Restart or Resume the DMS task.