Examkin

Question

Difficulty: HardBilling, Cost Management, and Resource Sharing Strategy

A financial services organization is consolidating its infrastructure under AWS Organizations with consolidated billing enabled. To streamline operations and minimize costs, the infrastructure team wants to implement a shared VPC model where a centralized network account hosts and shares subnets with individual application accounts. The application accounts run various containerized and serverless workloads on Amazon EC2, AWS Fargate, and AWS Lambda. Additionally, the compliance team requires that AWS CloudTrail logs from all member accounts be written to a single Amazon S3 bucket in a dedicated security audit account, encrypted using keys that support cross-account sharing and customized key rotation schedules.

Which TWO actions should the Solutions Architect take to meet these requirements?

  1. Enable resource sharing within AWS Organizations from the management account. In the Network account, create a resource share using AWS Resource Access Manager (RAM), add the subnets, and share them with the entire organization. Purchase Compute Savings Plans in the Organizations management account to automatically apply discounts to the EC2, Fargate, and Lambda workloads across all member accounts.Answer
  2. B
    In the Network account, create an AWS Resource Access Manager (RAM) resource share for the subnets and share them individually with each member account's 1212-digit AWS account ID. Purchase EC2 Instance Savings Plans in the Organizations management account to optimize compute costs for the EC2, Fargate, and Lambda workloads in all member accounts.
  3. In the security audit account, configure the S3 bucket policy to allow the AWS CloudTrail service principal (cloudtrail.amazonaws.com) to write logs, using a condition key that restricts access to the organization's ID. Use Customer Managed Keys (CMKs) to encrypt the CloudTrail logs and other shared resources, configuring key policies to permit cross-account usage.Answer
  4. D
    Attach a Service Control Policy (SCP) at the root of the organization that explicitly grants s3:PutObject permissions to the CloudTrail service principal for the centralized S3 bucket. Encrypt the central S3 bucket using the AWS-managed key aws/s3 to automatically handle decryption and logging permissions across all member accounts without modifying key policies.
  5. E
    In the security audit account, configure the central S3 bucket policy to grant write access to the root principal of each member account, relying on the member accounts' local IAM policies to delegate write permissions to the CloudTrail service. Encrypt the bucket using the default AWS-managed KMS key aws/s3 to avoid the overhead of managing custom key policies.

Answer

Enable resource sharing within AWS Organizations from the management account, share the subnets using AWS RAM with the organization, purchase Compute Savings Plans in the management account, configure the centralized S3 bucket policy to allow the CloudTrail service principal with an organization ID condition, and use Customer Managed Keys (CMKs) for encryption.
To share VPC subnets across an organization using AWS Resource Access Manager (RAM), sharing must first be enabled within the AWS Organizations management account. Once enabled, the network account can share subnets with the entire organization or specific OUs without requiring individual resource invitations. To cover a combination of EC2, Fargate, and Lambda workloads with a single cost-optimization instrument, Compute Savings Plans must be purchased in the management account, where consolidated billing allows the savings to apply across all member accounts. For cross-account resources and centralized CloudTrail logging, Customer Managed Keys (CMKs) must be used because AWS-managed keys (like aws/s3 or aws/ebs) cannot be shared across accounts or have their key policies modified. The central S3 bucket policy must grant write permissions to the CloudTrail service principal (cloudtrail.amazonaws.com) with a condition restricting access to the specific AWS Organization ID to ensure secure, automated log delivery.

Step-by-Step Solution

1
Determine the appropriate resource sharing model for the subnets across the organization.
Enable RAM sharing in the AWS Organizations management account and share the subnets from the Network account to the Organization.
This permits subnet sharing across all member accounts without sending or accepting individual resource invitations.
2
Identify the correct Savings Plan type to optimize the compute workloads.
Select and purchase Compute Savings Plans in the consolidated billing management account.
Compute Savings Plans cover Amazon EC2, AWS Fargate, and AWS Lambda workloads, whereas EC2 Instance Savings Plans only cover EC2.
3
Design the centralized logging and cross-account encryption strategy.
Configure a centralized S3 bucket policy to allow the CloudTrail service principal (cloudtrail.amazonaws.com) to write logs, restricted by the organization ID, and use Customer Managed Keys (CMKs) for encryption.
AWS-managed KMS keys cannot have their policies modified for cross-account access, making Customer Managed Keys necessary for cross-account resource encryption and logging.

Key Concept

Multi-account resource sharing, centralized billing cost optimization, and secure cross-account logging integration.
Rate this question

Topics

Billing, Cost Management, and Resource Sharing Strategy

More questions from this topic