Examkin

Question

Difficulty: HardBilling, Cost Management, and Resource Sharing Strategy

An enterprise manages its multi-account AWS environment using AWS Organizations. The environment consists of a Management account, a Core-Network OU, a Production OU, and a Development OU. The Core-Network OU contains a Shared-VPC account where VPC subnets are shared with the Production and Development OUs using AWS Resource Access Manager (RAM).

The workloads in the Production OU consist of a mixture of Amazon EC2 instances, AWS Lambda functions, and Amazon ECS tasks running on AWS Fargate. These workloads mount Amazon EFS file systems that are located in the Shared-VPC account and must be encrypted at rest.

The finance team wants to reduce compute costs for the Production OU workloads using Savings Plans, but wants to ensure that these discount benefits are never applied to the Development OU.

Which two actions should the solutions architect take to meet these requirements?

  1. Purchase Compute Savings Plans in the Production OU member accounts, and disable Savings Plans sharing in the Billing Preferences of the Management account.Answer
  2. Create a Customer Managed Key (CMK) in the Shared-VPC account to encrypt the EFS file systems, and configure its key policy to allow the IAM roles in the Production OU accounts to perform KMS decrypt and generate data key operations.Answer
  3. C
    Purchase EC2 Instance Savings Plans in the Management account, and attach a Service Control Policy (SCP) to the Development OU that blocks the application of savings discounts using the `savingsplans:Apply` action.
  4. D
    Encrypt the EFS file systems using the default AWS-managed key (`aws/elasticfilesystem`) in the Shared-VPC account, and configure the key policy to trust the root ARN of the Production OU member accounts.
  5. E
    Create a resource share in AWS Resource Access Manager (RAM) to share the EFS file systems directly with the Production OU, ensuring that sharing with external entities is enabled in the Management account's RAM preferences.

Answer

Purchase Compute Savings Plans in the Production OU member accounts and disable Savings Plans sharing in the Billing Preferences of the Management account; and create a Customer Managed Key (CMK) in the Shared-VPC account to encrypt the EFS file systems, configuring its key policy to allow the IAM roles in the Production OU accounts to use the key.
Purchasing Compute Savings Plans directly in the Production OU accounts and disabling sharing in the Management account ensures that only the production workloads benefit from the savings. Additionally, using a Customer Managed Key (CMK) with a cross-account key policy allows the ECS Fargate tasks in the Production OU accounts to mount and access the encrypted EFS file systems created in the shared VPC subnets.

Step-by-Step Solution

1
Select the correct Savings Plan type for the heterogeneous compute workload.
Compute Savings Plans are selected because they cover EC2, AWS Lambda, and AWS Fargate, whereas EC2 Instance Savings Plans only cover EC2.
The production workload includes Lambda and Fargate in addition to EC2, requiring the flexible Compute Savings Plans.
2
Isolate the Savings Plans benefits to the Production OU.
Savings Plans sharing is disabled in the Billing Preferences of the Management account, and the Compute Savings Plans are purchased directly within the Production OU member accounts.
By default, Savings Plans benefits are shared across all accounts in the Organization. Disabling sharing ensures they only apply to the account that purchased them.
3
Establish cross-account encryption capability for shared EFS file systems.
A Customer Managed Key (CMK) is created in the Shared-VPC account, and its key policy is configured to trust the application IAM roles in the Production OU.
AWS-managed keys cannot be shared across accounts because their key policies cannot be modified. A CMK must be used to delegate cross-account access.

Key Concept

To share encrypted resources across accounts in an AWS Organization, a Customer Managed Key (CMK) must be used because AWS-managed keys cannot be shared. To prevent Savings Plans benefits from applying to specific accounts, Savings Plans sharing must be disabled in the Management account, and the plans must be purchased directly in the targeted accounts.
Rate this question

Topics

Billing, Cost Management, and Resource Sharing Strategy

More questions from this topic