Examkin

Question

Difficulty: HardConsolidated Billing and AWS Organizations

A logistics enterprise acquires a regional delivery partner and moves the partner's standalone AWS account into the enterprise's AWS Organizations structure. The enterprise organization uses consolidated billing and has a Service Control Policy (SCP) at the root level that denies access to Amazon Redshift. The partner account contains active EC2 Reserved Instances (RIs) and has an IAM administrator user who needs to manage an existing Amazon Redshift cluster. Which of the following describes the immediate impact of this integration on the partner account's billing and service access?

  1. The partner account's billing is consolidated under the enterprise, its EC2 usage qualifies for the enterprise's volume pricing discounts, and the IAM administrator is immediately blocked from accessing Amazon Redshift.Answer
  2. B
    The partner account maintains independent billing until the end of the month, and the IAM administrator can still access Amazon Redshift because SCPs do not override local administrator permissions.
  3. C
    The partner account's billing is consolidated immediately, but its active Reserved Instances cannot be shared with the enterprise, and the Redshift restriction only applies if the account is placed in a custom Organizational Unit (OU).
  4. D
    The partner account's billing remains separate under the AWS Shared Responsibility Model, and the enterprise must use IAM policies in the management account to block Amazon Redshift access on the member account.

Answer

The partner account's billing is consolidated under the enterprise, its EC2 usage qualifies for the enterprise's volume pricing discounts, and the IAM administrator is immediately blocked from accessing Amazon Redshift.
Upon joining an AWS Organization, a member account's billing immediately consolidates under the organization's management account. This allows the organization to benefit from aggregated volume pricing discounts and share existing Reserved Instances. At the same time, any Service Control Policies (SCPs) applied at the organization's root or OUs act as permission guardrails that filter the account's permissions. Because the root SCP denies access to Amazon Redshift, this restriction immediately overrides any local IAM permissions, blocking the administrator user from managing the Amazon Redshift cluster.

Step-by-Step Solution

1
Analyze the impact on billing consolidation.
The standalone account's billing is linked to the organization's management account immediately upon accepting the invitation.
AWS Organizations features consolidated billing, which aggregates payments and usage immediately across all member accounts.
2
Evaluate volume discounts and Reserved Instance sharing.
The partner account's active RIs can be shared across the organization, and its resource usage aggregates towards volume tiers.
By default, consolidated billing enables sharing of Reserved Instances and Savings Plans across all linked accounts to minimize costs.
3
Assess the behavior of Service Control Policies (SCPs) on administrative access.
The root-level SCP denying Amazon Redshift overrides the local IAM administrator permissions, blocking access.
SCPs define the maximum permission boundary for an account. They apply to all users and roles within member accounts, including the account root user and administrator roles.

Key Concept

AWS Organizations Consolidated Billing and Service Control Policies (SCPs)
Estimated Time:2m 0s
Rate this question

Topics

Consolidated Billing and AWS Organizations

More questions from this topic