Examkin

Question

Difficulty: Very hardBilling, Cost Management, and Resource Sharing Strategy

An enterprise manages a multi-account environment under AWS Organizations with consolidated billing. The environment contains a Management account, a Shared Services Network account, a Security account, and several Line of Business (LOB) member accounts grouped into Production and Development/Test Organizational Units (OUs). A solutions architect must design a solution to meet the following requirements:
1. Share VPC subnets from the central Shared Services Network account to the LOB member accounts to enable application deployments while preventing LOBs from creating their own VPCs or internet gateways.
2. Centrally log all API activity across all accounts to a single S3 bucket in the Security account, ensuring all logs are encrypted at rest using a customer-controlled KMS key and that log integrity is validated.
3. Apply Compute Savings Plans purchased in the Management account only to production workloads in the Production OU, ensuring development and testing workloads in the Development/Test OU do not receive the discount benefits.

Which TWO architectural steps must the solutions architect take to meet these requirements?

  1. In the Billing Console of the Management account, navigate to Preferences and disable Savings Plans discount sharing for the member accounts under the Development/Test OU. In the Shared Services Network account, create resource shares in AWS Resource Access Manager (RAM) to share specific VPC subnets with the Development/Test and Production OUs, ensuring RAM sharing is enabled in the Management account.Answer
  2. In the Management account, create an organization trail in AWS CloudTrail and configure it to deliver log files to an Amazon S3 bucket in the Security account. Configure the S3 bucket policy to allow the CloudTrail service principal to perform s3:PutObject with an Organization ID condition, and encrypt the logs using a Customer Managed Key (CMK) in the Security account with a key policy allowing CloudTrail to generate data keys and decrypt.Answer
  3. C
    In the Management account, create a Service Control Policy (SCP) and attach it to the Development/Test OU with a deny rule for the action savingsplans:ApplyDiscount. In the Shared Services Network account, use AWS Resource Access Manager (RAM) to share the entire VPC resource with the LOB member accounts, and configure the LOB accounts to automatically deploy resources into the shared VPC's default subnets.
  4. D
    In the Management account, create an organization trail in AWS CloudTrail and configure it to deliver logs to an S3 bucket in the Security account. Encrypt the log files using the AWS-managed KMS key for S3 (aws/s3) in the Security account to simplify key management, and configure the S3 bucket policy in the Security account to trust all accounts within the organization structure using a wildcard principal.
  5. E
    In the Management account, set up AWS Billing Conductor to create custom billing groups for each OU. Apply a global billing rule that blocks the application of Savings Plans discounts to any pro-forma bills generated for the Development/Test billing group, and configure AWS Resource Access Manager to share the Shared Services VPC with external entities.

Answer

Disable Savings Plans discount sharing for the Development/Test OU member accounts under Billing Preferences in the Management account, and use AWS Resource Access Manager to share subnets from the Network account. Create an organization trail in the Management account delivering logs to an S3 bucket in the Security account, using a Customer Managed Key with cross-account access policies for encryption.
The correct solution uses AWS Resource Access Manager to share specific VPC subnets from the Network account, enabling centralized control of networking while allowing LOB accounts to run workloads. It turns off Savings Plans discount sharing for non-production accounts under Billing Preferences in the Management account, which is the only way to selectively apply the discount. To meet the centralized logging requirement, it creates an organization trail delivering logs to an S3 bucket in the Security account, utilizing a Customer Managed Key (CMK) with a key policy configured to allow cross-account encryption because AWS-managed keys cannot be shared cross-account.

Step-by-Step Solution

1
Disable Savings Plans discount sharing for selected development/test accounts.
Savings Plans discounts purchased in the Management account will only apply to the remaining accounts (such as production workloads).
By default, Savings Plans discounts are shared across all accounts in an organization; disabling sharing for specific accounts is managed via Billing Preferences in the Management account.
2
Share specific subnets from the Shared Services Network account using AWS Resource Access Manager (RAM).
LOB accounts can deploy resources into the shared subnets but cannot modify the VPC configuration or create internet gateways.
AWS RAM allows sharing of subnets to other accounts in the organization, enforcing segregation of duties and keeping VPC control centralized.
3
Create an Organization Trail in AWS CloudTrail from the Management account.
API activity from all member accounts is captured and centralized.
An Organization Trail ensures that log collection is enabled globally and cannot be modified by member accounts.
4
Configure the centralized S3 bucket and a Customer Managed KMS Key (CMK) in the Security account.
Logs are securely delivered and encrypted using a key whose policy allows cross-account access from the organization trail.
AWS-managed KMS keys do not support cross-account operations, making a Customer Managed Key mandatory for this setup.

Key Concept

Multi-account resource sharing, centralized logging, and cost optimization strategy
Rate this question

Topics

Billing, Cost Management, and Resource Sharing Strategy

More questions from this topic