A healthcare group runs 40 member accounts with PHI databases that require daily backups, cross-account vault copies, and evidence that retention cannot be shortened by workload owners. Which centralized backup governance design meets these business continuity and compliance needs?
Select an answer to reveal the explanation.
Short Explanation
You've got 40 accounts to protect, so you can't rely on everyone remembering backups like locking up at night. With backup policy, you enforce daily schedules and tamper-proof copies in a central vault that no workload owner can weaken.
Full Explanation
AWS Backup integrates with Organizations to deploy backup policies that centrally assign backup plans, resource selections, and cross-account and cross-Region copy actions, while the central vault with Vault Lock in compliance mode prevents retention shortening for audit evidence. EBS and RDS snapshots with S3 copies fail by concept because decentralized lifecycle policies lack central governance, cross-account policy enforcement, and immutable retention controls. Elastic Disaster Recovery fails by concept because continuous replication serves failover rather than governed point-in-time backups with legal-hold retention. StackSets cron jobs fail by concept because custom scripts fragment monitoring and compliance reporting instead of providing centralized backup governance. Exam caveat: remember Vault Lock governance versus compliance mode implications for retention changes. Practical check: test restores from the central vault and confirm backup policy inheritance in a new member account.