Examkin

Question

Difficulty: Very hardBilling, Cost Management, and Resource Sharing Strategy

An enterprise manages a multi-account environment using AWS Organizations with consolidated billing. A solutions architect is designing a shared networking and security architecture with the following requirements:
* Subnets from a single VPC in a central Network account must be shared with multiple Application accounts inside specific Organizational Units (OUs) to run a combination of Amazon EC2 instances and AWS Fargate tasks.
* All Amazon EBS volumes launched within the Application accounts must be encrypted at rest using a Key Management Service (KMS) key managed in a centralized Shared Services account.
* API activity across all organizational accounts must be logged to a central S3 bucket in a Security account using an organizational trail.
* The enterprise wants to maximize discount coverage across both the EC2 instances and Fargate tasks.

Which of the following strategies should the solutions architect implement?

  1. Enable sharing with AWS Organizations in AWS Resource Access Manager (RAM). In the Network account, create a resource share for the subnets and associate it with the Application OUs. In the Shared Services account, create a Customer Managed Key (CMK) and configure its key policy to allow the Application accounts' IAM roles to perform key operations and create grants. In the Security account, configure the S3 bucket policy to allow the cloudtrail.amazonaws.com service principal to perform s3:PutObject with a condition matching aws:PrincipalOrgID. Purchase Compute Savings Plans in the Management account.Answer
  2. B
    Enable sharing with AWS Organizations in AWS Resource Access Manager (RAM). In the Network account, create a resource share for the subnets and associate it with the Application OUs. In the Shared Services account, create a Customer Managed Key (CMK) and configure its key policy to allow the Application accounts' IAM roles to perform key operations and create grants. In the Security account, configure the S3 bucket policy to allow the cloudtrail.amazonaws.com service principal to perform s3:PutObject with a condition matching aws:PrincipalOrgID. Purchase EC2 Instance Savings Plans in the Management account.
  3. C
    Enable sharing with AWS Organizations in AWS Resource Access Manager (RAM). In the Network account, create a resource share for the subnets and associate it with the Application OUs. In the Shared Services account, use the AWS-managed KMS key (aws/ebs) and modify its key policy to allow cross-account access for the Application accounts. In the Security account, configure the S3 bucket policy to allow the cloudtrail.amazonaws.com service principal to perform s3:PutObject with a condition matching aws:PrincipalOrgID. Purchase Compute Savings Plans in the Management account.
  4. D
    Enable sharing with AWS Organizations in AWS Resource Access Manager (RAM). In the Network account, create a resource share for the subnets and associate it with the Application OUs. In the Shared Services account, create a Customer Managed Key (CMK) and configure its key policy to allow the Application accounts' IAM roles to perform key operations and create grants. In the Security account, configure the S3 bucket with an IAM policy attached to the logging role in the management account to grant write permissions. Purchase Compute Savings Plans in the Management account.

Answer

The correct strategy involves enabling Organization sharing in RAM to share subnets, creating a Customer Managed Key (CMK) in the Shared Services account with key policy delegations, using an S3 bucket policy in the Security account to permit the CloudTrail service principal to perform write operations, and purchasing Compute Savings Plans to cover both EC2 and Fargate workloads.
The correct strategy correctly integrates AWS RAM subnet sharing with Customer Managed Keys (CMKs) for cross-account EBS encryption, sets up a secure S3 bucket policy allowing cross-account CloudTrail log delivery from the organization, and uses Compute Savings Plans to cover both EC2 and Fargate compute costs.

Step-by-Step Solution

1
Configure subnet sharing using AWS Resource Access Manager (RAM).
AWS Organizations sharing is enabled in RAM, allowing the Network account to share its subnets with the target application OUs.
VPC sharing via RAM requires organization-level sharing to be enabled to target OUs or the entire organization.
2
Set up centralized cross-account EBS encryption.
A Customer Managed Key (CMK) is created in the Shared Services account, with a key policy allowing spoke accounts to perform cryptographic operations and create grants.
AWS-managed keys (like aws/ebs) cannot be shared across accounts or have their policies modified, meaning a custom CMK is required for cross-account KMS delegation.
3
Configure the central S3 bucket policy for organizational CloudTrail logging.
An S3 bucket policy is configured in the Security account allowing the cloudtrail.amazonaws.com service principal to write logs, restricted by the aws:PrincipalOrgID condition.
CloudTrail writes logs directly to the target bucket using its service principal, so a resource-based S3 bucket policy must grant cross-account write permissions.
4
Purchase the correct Savings Plan type in the management account.
Compute Savings Plans are purchased to maximize cost savings across both EC2 and Fargate tasks.
Compute Savings Plans apply to EC2, Fargate, and Lambda, whereas EC2 Instance Savings Plans only apply to EC2 instances, leaving Fargate tasks uncovered.

Key Concept

Multi-account resource sharing, cross-account KMS access control, centralized S3 logging for CloudTrail, and compute cost optimization strategy.
Rate this question

Topics

Billing, Cost Management, and Resource Sharing Strategy

More questions from this topic