Examkin

Question

Difficulty: Very hardConsolidated Billing and AWS Organizations

A multinational company is designing its multi-account strategy using AWS Organizations. The IT and finance teams have the following requirements:

1. Member accounts must be restricted from modifying key security resources (such as AWS CloudTrail), while ensuring the management account remains completely unaffected by these restrictions.
2. Amazon S3 storage usage must be aggregated across all member accounts to qualify for active volume pricing discounts.
3. Member accounts must be prevented from automatically sharing and consuming unused Savings Plans purchased by other specific accounts within the organization to keep departmental budgets predictable.

Which combination of AWS Organizations features and configurations will satisfy all of these requirements?

  1. Apply Service Control Policies (SCPs) to the member accounts to restrict security resource modifications; enable Consolidated Billing to automatically aggregate S3 usage for volume discounts; and disable Savings Plan sharing in the Billing Preferences of the management account.Answer
  2. B
    Apply IAM Policies to the management account to restrict security resource modifications; enable Consolidated Billing to aggregate S3 usage; and disable Savings Plan sharing by creating individual Service Control Policies (SCPs) that deny Savings Plan consumption in member accounts.
  3. C
    Apply Service Control Policies (SCPs) at the root level of the organization to restrict security modifications across all accounts, including the management account; configure AWS Budgets to aggregate S3 billing data; and disable Savings Plan sharing using Billing Cost Allocation Tags on each member account.
  4. D
    Apply Service Control Policies (SCPs) to member accounts; use AWS Cost Explorer to aggregate S3 usage; and configure individual IAM Policies on member account root users to block Savings Plan sharing.

Answer

Applying Service Control Policies (SCPs) to member accounts, enabling Consolidated Billing to aggregate usage, and disabling Savings Plan sharing in the Billing Preferences of the management account.
Applying Service Control Policies (SCPs) to member accounts restricts their permissions without affecting the management account. Consolidated Billing aggregates usage across all accounts to qualify for volume pricing discounts. Disabling Savings Plan sharing in the Billing Preferences of the management account prevents member accounts from automatically sharing and consuming unused Savings Plans.

Step-by-Step Solution

1
Determine how to enforce permission boundaries on member accounts without restricting the management account.
Apply Service Control Policies (SCPs) to member accounts or Organizational Units (OUs).
SCPs define maximum permission boundaries for member accounts but do not apply to the management (payer) account, preserving its administrative capabilities.
2
Determine how to combine S3 usage across accounts to achieve volume discounts.
Use Consolidated Billing, which is a feature of AWS Organizations.
Consolidated Billing aggregates usage across all member accounts, enabling the organization to reach higher volume tiers and lower unit rates for S3 storage.
3
Determine how to disable discount sharing for Savings Plans across accounts.
Disable Savings Plan sharing in the Billing Preferences of the management account.
By default, Savings Plans discounts are shared among all accounts in an organization. This behavior can be disabled at the payer (management) account level in the Billing Preferences pane.

Key Concept

Consolidated Billing and AWS Organizations
Rate this question

Topics

Consolidated Billing and AWS Organizations

More questions from this topic