Examkin

Question

Difficulty: HardBilling, Cost Management, and Resource Sharing Strategy

An enterprise manages its multi-account environment using AWS Organizations. The architecture consists of a Management account, a central Network account, a dedicated Log Archive account, and multiple Application accounts. A solutions architect is designing a resource sharing and cost management strategy with the following requirements:

* Subnets from a central VPC in the Network account must be shared with the Application accounts to run EC2 instances and ECS tasks on AWS Fargate.
* Application teams must be able to control network traffic to their resources within these shared subnets.
* AWS CloudTrail logs from all accounts must be consolidated into a single S3 bucket in the Log Archive account. These logs must be encrypted using a KMS key that the security team can rotate manually.
* The company wants to maximize cost savings for both EC2 and Fargate workloads across all accounts in the organization.

Which strategy should the solutions architect implement to meet these requirements?

  1. Enable resource sharing within the organization in the Management account. In the Network account, use AWS Resource Access Manager (RAM) to share the private subnets with the Application accounts. Instruct the application teams to create and associate their own security groups locally within their accounts. In the Log Archive account, create an S3 bucket and a customer managed KMS key. Configure the S3 bucket policy to allow the CloudTrail service principal to write logs using the aws:PrincipalOrgID condition, and allow the service principal to use the KMS key. Configure CloudTrail in all accounts to send logs to this bucket. Purchase Compute Savings Plans in the Management account with sharing enabled.Answer
  2. B
    Enable resource sharing within the organization in the Management account. In the Network account, use AWS RAM to share the private subnets and central security groups with the Application accounts. In the Log Archive account, create an S3 bucket and encrypt it using the default AWS-managed S3 key (aws/s3). Modify the key policy of aws/s3 to permit cross-account CloudTrail access. Configure CloudTrail in all accounts to send logs to this bucket. Purchase Compute Savings Plans in the Management account with sharing enabled.
  3. C
    Enable resource sharing within the organization in the Management account. In the Network account, use AWS RAM to share the private subnets with the Application accounts. Instruct the application teams to create their own security groups. In the Log Archive account, create an S3 bucket. Apply a Service Control Policy (SCP) at the root level of the organization that grants s3:PutObject permission on the Log Archive S3 bucket to all member accounts. Purchase EC2 Instance Savings Plans in the Management account with sharing enabled.
  4. D
    Enable resource sharing within the organization in the Management account. In the Network account, use AWS RAM to share the private subnets with the Application accounts. Instruct the application teams to create their own security groups. In the Log Archive account, create an S3 bucket and a customer managed KMS key. Configure the S3 bucket policy to allow access only to the Management account's root principal. Configure CloudTrail in all accounts to send logs to this bucket. Purchase Compute Savings Plans in the Management account with sharing disabled, and manually transfer the Savings Plans credits to the member accounts.

Answer

The solutions architect should enable resource sharing in the Management account, share private subnets using AWS RAM, and have application teams create their own local security groups. To centralize logs, they should use a customer managed KMS key and an S3 bucket policy with the aws:PrincipalOrgID condition. To maximize savings across both EC2 and Fargate, they should purchase Compute Savings Plans in the Management account with sharing enabled.
The correct strategy coordinates AWS RAM, custom KMS encryption, and Compute Savings Plans properly. AWS Resource Access Manager (RAM) allows sharing VPC subnets within an AWS Organization. Security groups cannot be shared using RAM, so participant accounts must create their own security groups locally. For centralized logging, a customer managed KMS key is necessary because AWS-managed keys (like aws/s3) cannot be shared or modified. Finally, Compute Savings Plans purchased in the Management account automatically apply to EC2 and Fargate across the organization when billing sharing is enabled.

Step-by-Step Solution

1
Configure VPC sharing using AWS Resource Access Manager (RAM).
Private subnets from the Network account are shared with the Application accounts. Application teams can deploy EC2 instances and ECS Fargate tasks in these subnets but must create their own local security groups, as security groups cannot be shared via RAM.
This establishes shared network infrastructure while maintaining isolation of security group management within the application teams.
2
Set up centralized CloudTrail logging in the Log Archive account.
An S3 bucket is created with a bucket policy allowing the cloudtrail.amazonaws.com service principal to write logs, restricted to the organization using the aws:PrincipalOrgID condition. A customer managed KMS key is created with a policy permitting CloudTrail access.
AWS-managed KMS keys (like aws/s3) do not support policy modification and cannot be used for cross-account CloudTrail encryption. A customer managed key is required.
3
Implement the cost management strategy using Savings Plans.
Compute Savings Plans are purchased in the Management account, and sharing is enabled in the consolidated billing configuration.
Compute Savings Plans cover both EC2 and Fargate workloads. Having sharing enabled allows unused savings from the Management account to apply to member accounts, maximizing cost efficiency.

Key Concept

Multi-account resource sharing with AWS RAM, cross-account log consolidation with customer managed KMS keys, and cost optimization via Compute Savings Plans.
Estimated Time:3m 0s
Rate this question

Topics

Billing, Cost Management, and Resource Sharing Strategy

More questions from this topic