A company uses AWS Organizations to manage a multi-account environment. The Network team has created a central VPC in a dedicated Network account. They need to share several private subnets from this VPC with application teams in other member accounts of the organization. The application teams deploy workloads consisting of Amazon EC2 instances, Amazon ECS tasks running on AWS Fargate, and AWS Lambda functions. All workloads must encrypt their data at rest, and the encryption keys must be managed centrally in a Security account. Additionally, the company wants to optimize compute costs across all accounts, including the serverless runtimes. Which of the following architectural strategies should the Solutions Architect implement to meet these requirements?
- Enable sharing with AWS Organizations in AWS RAM. In the Network account, create a resource share for the subnets and associate it with the Organization. In the Security account, create KMS Customer Managed Keys and configure key policies that grant cross-account access to the application roles. In the organization's management account, purchase Compute Savings Plans.Answer
- BEnable sharing with AWS Organizations in AWS RAM. In the Network account, create a resource share for the subnets and associate it with the Organization. In the Security account, use AWS-managed KMS keys (such as aws/ebs and aws/s3) and modify their key policies to grant cross-account access to the application roles. In the organization's management account, purchase Compute Savings Plans.
- CEnable sharing with AWS Organizations in AWS RAM. In the Network account, create a resource share for the subnets and associate it with the Organization. In the Security account, create KMS Customer Managed Keys and configure key policies that grant cross-account access to the application roles. In the organization's management account, purchase EC2 Instance Savings Plans.
- DIn the Network account, create a resource share in AWS RAM for the subnets and target the account IDs of external partner accounts, without enabling the setting to allow sharing with external entities in the AWS RAM console. In the Security account, create KMS Customer Managed Keys and configure key policies that grant cross-account access. In the organization's management account, purchase Compute Savings Plans.