Examkin

Question

Difficulty: HardBilling, Cost Management, and Resource Sharing Strategy

An enterprise manages a multi-account environment using AWS Organizations with consolidated billing. The architecture includes a management account, a shared networking account, and multiple member accounts for application teams.

The solutions architect must design a resource sharing and cost management strategy with the following requirements:
- Share VPC subnets from the networking account to application member accounts to allow application deployments.
- Ensure EBS volumes created by application teams in their respective accounts are encrypted using a centralized KMS key managed by the Security team in a dedicated Security account.
- Maximize cost savings across the organization, which runs a combination of Amazon EC2 instances, AWS Fargate tasks, and AWS Lambda functions across all application accounts.
- Ensure the sharing of VPC subnets is restricted strictly to accounts within the AWS Organization.

Which of the following strategies represents the most secure, operationally efficient, and cost-effective solution to meet these requirements?

  1. A
    In the networking account, create an AWS Resource Access Manager (RAM) resource share for the subnets, selecting the AWS Organization ID as the principal, without enabling resource sharing in the AWS Organizations management account. In the Security account, create a KMS Customer Managed Key (CMK) with a key policy allowing cross-account access. In the management account, purchase Compute Savings Plans, and disable billing sharing in the consolidated billing settings to force the discount application to be calculated individually in each member account's console.
  2. B
    In the networking account, create an AWS RAM resource share for the subnets, selecting the individual application account IDs as principals. In the Security account, use the AWS managed key (aws/ebs) and update its policy to allow the application accounts to perform cryptographic operations. In the management account, purchase EC2 Instance Savings Plans to maximize discounts for the EC2, Fargate, and Lambda workloads.
  3. Enable resource sharing in the AWS Organizations management account. In the networking account, create an AWS Resource Access Manager (RAM) resource share for the subnets, selecting the AWS Organization ID as the principal. In the Security account, create a KMS Customer Managed Key (CMK) with a key policy that allows root-level principal access from the application accounts, and configure local IAM policies in the application accounts to delegate permissions. In the management account, purchase Compute Savings Plans to cover EC2, Fargate, and Lambda usage across all consolidated accounts.Answer
  4. D
    Enable resource sharing in the AWS Organizations management account. In the networking account, create an AWS RAM resource share for the subnets, selecting the AWS Organization ID as the principal. In the Security account, create a KMS Customer Managed Key (CMK). Attach a Service Control Policy (SCP) to the application accounts' OU that explicitly grants kms:Decrypt and kms:GenerateDataKeyWithoutPlaintext permissions to all local IAM users, assuming this grants permissions without local IAM policies. In the management account, purchase EC2 Instance Savings Plans.

Answer

The correct strategy enables resource sharing in the AWS Organizations management account, creates an AWS RAM resource share for the subnets targeting the AWS Organization ID, uses a KMS Customer Managed Key (CMK) in the Security account with delegated policy access to application accounts, and purchases Compute Savings Plans in the management account.
The correct strategy enables resource sharing at the organization level to allow seamless sharing of subnets using the Organization ID as the principal. It utilizes a Customer Managed Key (CMK) in the Security account since AWS-managed keys cannot be shared across accounts. The CMK key policy delegates permission to the member accounts, which then use local IAM policies to grant access. Finally, purchasing Compute Savings Plans in the consolidated billing management account ensures discounts are applied to EC2, Fargate, and Lambda across all member accounts.

Step-by-Step Solution

1
Enable resource sharing in the AWS Organizations management account and share the subnets via AWS RAM.
Subnets are successfully shared with member accounts within the AWS Organization without requiring manual invitations.
AWS RAM requires organizational sharing to be enabled in the management account to share resources using Organization or OU IDs as principals; otherwise, the sharing operation will fail or require external invitations.
2
Create a Customer Managed Key (CMK) in the Security account and delegate permissions to the application accounts.
The application accounts can use the CMK to encrypt and decrypt their EBS volumes.
AWS-managed KMS keys (like aws/ebs) cannot be shared across accounts because their key policies cannot be modified. A Customer Managed Key must be used with a key policy that delegates access to root in the application accounts, allowing local IAM policies to grant permissions to local roles.
3
Purchase Compute Savings Plans in the consolidated billing management account.
Cost savings are maximized and automatically applied to EC2, Fargate, and Lambda usage across all member accounts.
Compute Savings Plans apply to EC2, Fargate, and Lambda usage across the entire consolidated billing family, whereas EC2 Instance Savings Plans only apply to EC2 instances of a specific family and do not cover Fargate or Lambda.

Key Concept

Consolidated billing, cross-account resource sharing via AWS Resource Access Manager (RAM), cross-account KMS encryption, and organization-wide Savings Plans mapping.
Estimated Time:3m 0s
Rate this question

Topics

Billing, Cost Management, and Resource Sharing Strategy

More questions from this topic