Examkin

Question

Difficulty: MediumConsolidated Billing and AWS Organizations

A software-as-a-service (SaaS) company manages separate AWS accounts for its development, staging, and production environments. The finance team wants to receive a single monthly invoice for all accounts and benefit from aggregated volume pricing discounts for storage. At the same time, the security team must prevent users in the development accounts from deleting Amazon S3 buckets, even if those users have administrator permissions within their local accounts. Which of the following solutions should the company implement?

  1. A
    AWS Organizations with billing-only features enabled, combined with VPC Peering connections between all member accounts to share pricing tiers.
  2. B
    Individual AWS accounts linked using AWS Billing Conductor, with an IAM policy configured directly by the AWS account root user of each member account.
  3. AWS Organizations with consolidated billing enabled, and a Service Control Policy applied to the development accounts.Answer
  4. D
    AWS Billing and Cost Management console linked to AWS IAM Identity Center, with the AWS Shared Responsibility Model configured to prevent bucket deletion.

Answer

AWS Organizations with consolidated billing enabled, and a Service Control Policy applied to the development accounts.
AWS Organizations allows organizations to centrally manage billing and permissions across multiple AWS accounts. Enabling consolidated billing generates a single monthly invoice for the management account and aggregates usage across all member accounts to qualify for volume pricing discounts. Furthermore, Service Control Policies (SCPs) can be applied to organizational units or specific member accounts to restrict maximum permissions—such as preventing S3 bucket deletion—which overrides even administrative permissions within those member accounts.

Step-by-Step Solution

1
Identify the mechanism for combining multiple AWS accounts into a single invoice and sharing pricing tiers.
AWS Organizations consolidated billing features allow multiple member accounts to be billed under a single management account, automatically aggregating usage to qualify for higher volume discounts (e.g., S3 storage tiers).
This addresses the finance team's requirement for a single invoice and cost optimization.
2
Identify the mechanism for enforcing resource-level restriction policies across member accounts.
Service Control Policies (SCPs) in AWS Organizations can specify maximum permission boundaries for member accounts, including blocking actions like S3 bucket deletion.
This addresses the security team's requirement to restrict actions centrally, even for administrative users in the member accounts.

Key Concept

Consolidated Billing and AWS Organizations
Estimated Time:1m 30s
Rate this question

Topics

Consolidated Billing and AWS Organizations

More questions from this topic