Examkin

Question

Difficulty: Very hardBilling, Cost Management, and Resource Sharing Strategy

An enterprise is designing a multi-account architecture on AWS using AWS Organizations with all features enabled. The networking team has created a centralized VPC in a dedicated Network account and wants to share specific subnets with application development teams operating in separate accounts under an Application Organizational Unit (OU). The application workloads run on a combination of Amazon EC2 instances and AWS Fargate tasks. All EBS volumes and S3 buckets must be encrypted at rest using keys managed in a centralized Security account. The finance team requires that cost optimization benefits are maximized across all compute workloads, and billing is consolidated. Which TWO strategies should the solutions architect implement to meet these requirements securely and cost-effectively?

  1. Enable resource sharing within AWS Organizations from the management account. In the Network account, use AWS Resource Access Manager (RAM) to create a resource share for the subnets and associate it with the Application OU. Purchase Compute Savings Plans in the Organizations management account to automatically apply discounts to both EC2 instances and Fargate tasks across the consolidated billing family.Answer
  2. In the Security account, create a Customer Managed Key (CMK) and configure its key policy to allow the IAM principals in the Application accounts to perform KMS cryptographic operations and create grants. In the Application accounts, configure IAM policies allowing users to create grants on the Security account's CMK, and specify this key when launching EC2 instances and creating S3 buckets.Answer
  3. C
    In the Security account, configure the AWS-managed KMS key for EBS (aws/ebs) with a cross-account key policy that lists the Application account root users as principals. In the Application accounts, configure the EC2 instances to use this AWS-managed key for encrypting all EBS volumes.
  4. D
    Attach a Service Control Policy (SCP) to the Application OU that explicitly grants ram:AssociateResourceShare permissions. In the Application accounts, configure the local IAM policies to automatically accept the subnet resource share invitations from the Network account.
  5. E
    Purchase EC2 Instance Savings Plans in the Organizations management account to cover the compute usage of both EC2 and Fargate across all member accounts. In the Network account, use AWS RAM to create a resource share for the EC2 Instance Savings Plans and associate it with the Application OU.

Answer

The solutions architect should enable resource sharing in AWS Organizations, use AWS RAM to share the subnets from the Network account, and purchase Compute Savings Plans in the management account. In addition, they must use a Customer Managed Key in the Security account configured to allow cross-account access and grant creation.
The correct strategy combines AWS RAM subnet sharing with Compute Savings Plans. By enabling resource sharing in AWS Organizations, subnets shared via RAM are accepted automatically. Compute Savings Plans purchased in the management account apply to both EC2 and Fargate across all linked accounts. For centralized encryption, the Security account must use a Customer Managed Key (CMK) configured to allow cross-account access and grant creation so application accounts can encrypt EBS volumes and S3 buckets.

Step-by-Step Solution

1
Enable Resource Sharing in AWS Organizations
Enables organization-wide resource sharing without manual resource share invitations.
Allows AWS Resource Access Manager (RAM) to automatically share the subnets in the Network VPC with the Application OU.
2
Select and Purchase Compute Savings Plans
Applies discount rates automatically across the organization's EC2 and Fargate workloads.
Compute Savings Plans are required to cover both EC2 and Fargate workloads, whereas EC2 Instance Savings Plans only apply to EC2.
3
Create and Share a Customer Managed Key (CMK)
Establishes a key policy in the Security account allowing cross-account cryptographic actions and grant creation.
AWS-managed KMS keys cannot be shared cross-account, requiring a CMK to be created and delegated via key and IAM policies.

Key Concept

Multi-account resource sharing requires enabling Organizations integration in RAM. Cross-account key sharing requires Customer Managed Keys (CMKs) and grant permissions. Cost optimization across Fargate and EC2 requires Compute Savings Plans under consolidated billing.
Rate this question

Topics

Billing, Cost Management, and Resource Sharing Strategy

More questions from this topic