Examkin

Question

Difficulty: HardBilling, Cost Management, and Resource Sharing Strategy

A multinational enterprise manages its multi-account environment using AWS Organizations. The setup includes a management account, a central network account, and multiple member accounts for various business units. The network team needs to share private subnets and Transit Gateway attachments from the central network account to other internal member accounts. The security team requires all VPC Flow Logs to be encrypted using a Customer Managed Key (CMK). Additionally, a joint venture partner's account (Account P) must be billed under a separate pro forma structure that applies a 10% markup on standard AWS rates, and Account P must not benefit from any organization-wide volume discounts or Savings Plans. The remaining internal business units utilize a mix of Amazon EC2 and AWS Fargate, and they must share a discount model to optimize compute costs. Which combination of actions will meet these requirements with the least administrative effort?

  1. Enable resource sharing within AWS Organizations. In the central network account, create an AWS RAM resource share for the subnets and Transit Gateway targeting the organization's OUs. Use a Customer Managed Key (CMK) with a cross-account key policy to encrypt the destination S3 bucket for VPC Flow Logs. Purchase Compute Savings Plans in the management account, and disable discount sharing for Account P in the Billing Preferences. In AWS Billing Conductor, configure a billing group for Account P with a 10% global markup rule.Answer
  2. B
    Enable resource sharing within AWS Organizations. In the central network account, create an AWS RAM resource share for the subnets and Transit Gateway. Use the default AWS-managed KMS key (aws/s3) in the central network account to encrypt the Flow Logs S3 bucket. Purchase EC2 Instance Savings Plans in the management account, and disable discount sharing for Account P in the Billing Preferences. In AWS Billing Conductor, configure a billing group for Account P with a 10% global markup rule.
  3. C
    In the management account, attach a Service Control Policy (SCP) to the OU containing Account P that denies access to consolidated Savings Plans discounts and grants write permissions to the central Flow Logs bucket. Share the subnets and Transit Gateway from the central network account by creating an AWS RAM resource share targeting the specific account IDs of the internal business units. In AWS Billing Conductor, create a billing group containing Account P and apply a pricing rule with a 10% markup.
  4. D
    In the central network account, create an AWS RAM resource share for the subnets and Transit Gateway. Configure the share to allow external entities, and manually add the account IDs of the internal business units without enabling organizational sharing. Use a Customer Managed Key (CMK) in the central network account to encrypt the Flow Logs S3 bucket. Purchase Compute Savings Plans in the management account, and use IAM policies in Account P to deny access to Savings Plans resources. In AWS Billing Conductor, configure a billing group with a 10% markup for Account P.

Answer

Enable resource sharing within AWS Organizations. In the central network account, create an AWS RAM resource share for the subnets and Transit Gateway targeting the organization's OUs. Use a Customer Managed Key (CMK) with a cross-account key policy to encrypt the destination S3 bucket for VPC Flow Logs. Purchase Compute Savings Plans in the management account, and disable discount sharing for Account P in the Billing Preferences. In AWS Billing Conductor, configure a billing group for Account P with a 10% global markup rule.
The correct solution uses AWS RAM within the organization to share subnets and Transit Gateway attachments, which is a supported and secure sharing model. Using a Customer Managed Key (CMK) with a modified key policy allows cross-account logging services to encrypt and write to the centralized S3 bucket. Compute Savings Plans are selected because they apply to both EC2 and Fargate, and sharing is disabled specifically for the partner account using consolidated Billing Preferences. AWS Billing Conductor is used to create a billing group for the partner account and apply a 10% global markup rule for pro forma calculations.

Step-by-Step Solution

1
Enable sharing within the AWS Organization in AWS Resource Access Manager (RAM), then create a resource share for the subnets and Transit Gateway in the central network account targeting the organization's OUs.
Subnets and Transit Gateways are securely shared with the appropriate member accounts within the organizational boundary.
VPC subnets can only be shared via AWS RAM within the same AWS Organization, and organizational sharing must be explicitly enabled.
2
Create a Customer Managed Key (CMK) in the central network account, edit its key policy to allow cross-account access, and use it to encrypt the S3 bucket where Flow Logs are published.
Cross-account Flow Logs can be successfully written to and read from the encrypted S3 bucket.
AWS-managed keys (like aws/s3) cannot be shared across accounts because their key policies cannot be customized.
3
Purchase Compute Savings Plans in the management account, and configure Billing Preferences to disable discount sharing for Account P.
Compute costs for EC2 and Fargate are optimized for internal accounts, while Account P is excluded from these benefits.
Compute Savings Plans are needed to cover both EC2 and Fargate usage, and selectively disabling discount sharing at the management account level is the only way to exclude specific accounts.
4
Configure AWS Billing Conductor by creating a custom billing group containing Account P and applying a pricing rule with a 10% global markup.
Account P receives a customized pro forma billing view showing the 10% markup.
AWS Billing Conductor allows organizations to define custom pricing rules and billing groups for showback or chargeback purposes without affecting the consolidated billing invoice.

Key Concept

AWS RAM organizational sharing boundaries, cross-account KMS key policy delegation, Billing Preferences for selective Savings Plans sharing, and AWS Billing Conductor custom billing groups.
Rate this question

Topics

Billing, Cost Management, and Resource Sharing Strategy

More questions from this topic