Examkin

Question

Difficulty: HardBilling, Cost Management, and Resource Sharing Strategy

An enterprise is designing a multi-account architecture on AWS using AWS Organizations. The network engineering team has created a central transit VPC in a dedicated Network account and needs to share specific private subnets with application development teams in separate accounts. The application teams must be able to deploy Amazon EC2 instances and AWS Fargate tasks into these shared subnets but must not be allowed to modify VPC resources.

The finance department wants to maximize cost savings across all EC2, Fargate, and AWS Lambda workloads across all accounts under consolidated billing. Additionally, security compliance dictates that all application logs must be centrally written to a single Amazon S3 bucket in a Security account, encrypted using a customer-managed KMS key, and no member account should be able to alter the central logging configuration.

Which architectural strategy should a Solutions Architect recommend to meet these requirements?

  1. A
    Enable sharing within AWS Organizations in the AWS Resource Access Manager (RAM) console. In the Network account, create a resource share for the subnets and associate it with the target Organizational Units (OUs). Purchase EC2 Instance Savings Plans in the consolidated billing management account. In the Security account, configure an S3 bucket policy allowing write access from the member accounts, and encrypt the bucket using the AWS managed key (aws/s3) with cross-account access enabled.
  2. Enable sharing within AWS Organizations in the AWS Resource Access Manager (RAM) console. In the Network account, create a resource share for the subnets and associate it with the target OUs. Purchase Compute Savings Plans in the consolidated billing management account. In the Security account, configure an S3 bucket policy allowing s3:PutObject from the Organization's member accounts, and create a KMS Customer Managed Key (CMK) with a key policy allowing the member accounts' IAM roles kms:GenerateDataKey and kms:Decrypt permissions.Answer
  3. C
    In the Network account, create an AWS RAM resource share for the subnets and associate it with the application accounts, without enabling organization-wide sharing in the AWS RAM settings. Purchase Compute Savings Plans in the consolidated billing management account. In the Security account, configure an S3 bucket policy to allow writes from member accounts, and encrypt the bucket using a customer managed KMS key, relying solely on the bucket policy to delegate cross-account access to the KMS key.
  4. D
    Enable sharing within AWS Organizations in the AWS RAM console. In the Network account, create a resource share for the subnets and associate it with the target OUs. Purchase Compute Savings Plans in the consolidated billing management account. Create and attach a Service Control Policy (SCP) to the Root OU that explicitly grants the member accounts s3:PutObject access to the S3 bucket in the Security account and kms:GenerateDataKey access to the encryption key, without configuring local IAM policies or KMS key policies.

Answer

Enable sharing within AWS Organizations, share the subnets via AWS RAM to the target OUs, purchase Compute Savings Plans, configure S3 bucket policies for member account access, and create a customer managed KMS key with a key policy allowing cross-account access.
The correct strategy uses AWS Resource Access Manager (RAM) with organization sharing enabled to securely distribute subnets to target OUs. It uses Compute Savings Plans to cover the diverse compute portfolio of EC2, Fargate, and Lambda. Finally, it uses a Customer Managed Key (CMK) in the Security account with a key policy allowing kms:GenerateDataKey and kms:Decrypt alongside S3 bucket policies, which is the only valid way to handle cross-account KMS-encrypted writes.

Step-by-Step Solution

1
Configure AWS RAM to share subnets.
Enable organization-wide sharing in AWS RAM, then create a resource share in the Network account pointing to the private subnets and target the application OUs.
This grants application accounts the ability to deploy instances and tasks into the subnets without giving them administrative privileges over the VPC structure.
2
Select the correct cost optimization model.
Purchase Compute Savings Plans in the management account of the AWS Organization.
Compute Savings Plans are required to cover compute usage across EC2, Fargate, and Lambda dynamically, whereas EC2 Instance Savings Plans are restricted to EC2.
3
Establish secure cross-account logging and encryption.
Create an S3 bucket in the Security account with a bucket policy allowing s3:PutObject from the organization. Encrypt the bucket with a Customer Managed Key (CMK), configuring its key policy to allow member accounts kms:GenerateDataKey access.
AWS-managed KMS keys cannot be shared cross-account, so a CMK is required. Both the bucket policy and the key policy must grant permissions for cross-account S3 KMS writes.

Key Concept

Billing, Cost Management, and Resource Sharing Strategy
Estimated Time:2m 30s
Rate this question

Topics

Billing, Cost Management, and Resource Sharing Strategy

More questions from this topic