Examkin

Question

Difficulty: HardBilling, Cost Management, and Resource Sharing Strategy

An enterprise manages its multi-account environment using AWS Organizations. The environment consists of a Management account, a central Infrastructure account, a Security account, a Log Archive account, and three developer accounts (Dev1Dev1, Dev2Dev2, and Dev3Dev3).

A solutions architect must design a resource sharing, billing, and logging strategy that meets the following requirements:
* Subnets from a VPC in the Infrastructure account must be shared with the developer accounts to allow them to deploy EC2 instances.
* VPC Flow Logs for the shared subnets must be published to an Amazon S3 bucket in the Log Archive account. These logs must be encrypted at rest using an AWS KMS Customer Managed Key (CMK) stored in the Security account.
* Compute Savings Plans purchased in the Management account must apply only to Dev1Dev1 and Dev2Dev2. The Dev3Dev3 account must be excluded from receiving these discounts to maintain standard On-Demand pricing for external client auditing.
* Developer accounts must be restricted from sharing their own resources with external accounts outside the organization using AWS Resource Access Manager (RAM).

Which combination of actions should the solutions architect recommend to meet these requirements?

  1. A
    Enable resource sharing in AWS RAM for the organization. In the Infrastructure account, create a resource share for the subnets and share them with the developer accounts. Attach an SCP to the Developer OU that denies `ram:CreateResourceShare` and `ram:UpdateResourceShare` if `ram:AllowsExternalPrincipals` is set to true. In the Management account's Billing Preferences, keep discount sharing enabled, but uncheck the Dev3Dev3 account under the Savings Plans discount sharing preferences. In the Log Archive account, configure the S3 bucket to use the AWS-managed KMS key for S3 (`aws/s3`) to encrypt the flow logs, and grant the Security account access to the bucket.
  2. B
    Enable resource sharing in AWS RAM for the organization. In the Infrastructure account, create a resource share for the subnets and share them with the developer accounts. Attach an SCP to the Developer OU that denies `ram:CreateResourceShare` unless the principal is the Management account. In the Dev3Dev3 account's billing console, disable Savings Plans discount sharing. In the Security account, create a KMS CMK and configure its key policy to grant `delivery.logs.amazonaws.com` the `kms:GenerateDataKey*` and `kms:Decrypt` permissions. In the Log Archive account, configure the S3 bucket policy to allow `delivery.logs.amazonaws.com` to perform `s3:PutObject`.
  3. Enable resource sharing in AWS RAM for the organization. In the Infrastructure account, create a resource share for the subnets and share them with the developer accounts. Attach an SCP to the Developer OU that denies `ram:CreateResourceShare` and `ram:UpdateResourceShare` if `ram:AllowsExternalPrincipals` is set to true. In the Management account's Billing Preferences, keep discount sharing enabled, but uncheck the Dev3Dev3 account under the Savings Plans discount sharing preferences. In the Security account, create a KMS CMK and configure its key policy to grant `delivery.logs.amazonaws.com` the `kms:GenerateDataKey*` and `kms:Decrypt` permissions. In the Log Archive account, configure the S3 bucket policy to allow `delivery.logs.amazonaws.com` to perform `s3:PutObject`, and configure the bucket to use the KMS CMK in the Security account.Answer
  4. D
    In the Infrastructure account, create a resource share for the subnets, set `AllowExternalPrincipals` to true, and invite the developer accounts manually. Attach an SCP to the Developer OU that denies `ram:AcceptResourceShare` for any external resource shares. In the Management account's Billing Preferences, disable discount sharing globally, and purchase a separate Compute Savings Plan directly in the Dev1Dev1 and Dev2Dev2 accounts. In the Security account, create a KMS CMK and configure its key policy to grant `delivery.logs.amazonaws.com` the `kms:GenerateDataKey*` and `kms:Decrypt` permissions. In the Log Archive account, configure the S3 bucket policy to allow `delivery.logs.amazonaws.com` to perform `s3:PutObject`.

Answer

The correct strategy is to share subnets within the organization using AWS Resource Access Manager (RAM), disable Savings Plans discount sharing specifically for the third developer account in the Management account's Billing Preferences, restrict external RAM sharing using a Service Control Policy (SCP) with the `ram:AllowsExternalPrincipals` condition, and encrypt cross-account VPC Flow Logs using a Customer Managed Key (CMK) with a key policy that trusts the VPC Flow Logs service principal.
The correct strategy combines AWS RAM organizational sharing, granular discount sharing preferences in the Management account, a Service Control Policy to prevent external resource sharing, and cross-account logging using a Customer Managed Key. Using the Billing Preferences in the Management account allows selective exclusion of the third developer account from the Compute Savings Plans. Creating a Customer Managed Key in the Security account and configuring its policy to allow the `delivery.logs.amazonaws.com` service principal enables secure, cross-account encryption of VPC Flow Logs.

Step-by-Step Solution

1
Configure AWS RAM sharing within the organization.
Enable sharing within the organization in RAM settings, then share the subnets from the Infrastructure account with the developer accounts. This allows the developer accounts to access the shared subnets without manual acceptance.
This establishes secure, centralized resource sharing according to best practices.
2
Enforce sharing boundaries using a Service Control Policy (SCP).
Attach an SCP to the Developer OU that denies `ram:CreateResourceShare` and `ram:UpdateResourceShare` when the condition `ram:AllowsExternalPrincipals` is true.
This prevents developer accounts from sharing their local resources with external entities while permitting internal resource sharing.
3
Configure Savings Plans discount sharing preferences.
In the Management account's Billing Preferences, uncheck the third developer account from the discount sharing list while keeping the other developer accounts checked.
This selectively excludes the third developer account from receiving the shared Savings Plans discounts, leaving its resources to be billed at standard On-Demand rates for external client auditing.
4
Configure cross-account KMS and S3 bucket policies for encrypted VPC Flow Logs.
Create a Customer Managed Key (CMK) in the Security account. Add a policy statement allowing the VPC Flow Logs service principal (`delivery.logs.amazonaws.com`) permissions for `kms:GenerateDataKey*` and `kms:Decrypt`. In the Log Archive account, configure the S3 bucket policy to allow `delivery.logs.amazonaws.com` to write objects, and set the default bucket encryption to use the Security account's CMK.
This enables cross-account VPC Flow Logs delivery and encryption. AWS-managed keys cannot be used because their key policies cannot be customized to grant access to the service principal.

Key Concept

Centralized cost management and secure resource sharing are achieved by combining AWS Resource Access Manager (RAM), Service Control Policies (SCPs), Management account discount sharing preferences, and cross-account Customer Managed Keys (CMKs) to satisfy strict compliance and auditing boundaries.
Rate this question

Topics

Billing, Cost Management, and Resource Sharing Strategy

More questions from this topic