Examkin

Question

Difficulty: MediumBilling, Cost Management, and Resource Sharing Strategy

A technology company has a multi-account structure managed via AWS Organizations. The data engineering team in the Analytics account needs to run transient Amazon EMR clusters that access a centralized Amazon Aurora PostgreSQL database cluster situated in the Shared Services account. To comply with strict security requirements, the database must not be exposed to the public internet, and cross-account network traffic must avoid the data processing charges associated with Transit Gateway or VPC peering. The finance team requires that EMR compute costs are billed directly to the Analytics account, while the database storage and instance costs are billed to the Shared Services account. Which combination of actions will meet these requirements? (Select TWO.)

  1. In the Shared Services account, use AWS Resource Access Manager (RAM) to share the private subnets containing the Aurora database with the Analytics account.Answer
  2. In the Analytics account, launch the Amazon EMR clusters directly into the shared private subnets.Answer
  3. C
    In the Shared Services account, use AWS Resource Access Manager (RAM) to share the Aurora database cluster directly with the Analytics account.
  4. D
    In the management account, attach a Service Control Policy (SCP) to the Shared Services Organizational Unit (OU) that grants the Analytics IAM role permission to access the Aurora database.
  5. E
    In the Analytics account, configure a centralized S3 bucket policy for CloudTrail to allow the Shared Services account to deliver database access logs without using AWS Organizations.

Answer

In the Shared Services account, use AWS Resource Access Manager (RAM) to share the private subnets containing the Aurora database with the Analytics account, and in the Analytics account, launch the Amazon EMR clusters directly into the shared private subnets.
By sharing private subnets from the Shared Services account using AWS Resource Access Manager (RAM), resources created in the Analytics account can reside in the same VPC as the Aurora database. This configuration permits direct private IP communication without the need for VPC peering or Transit Gateway, thereby avoiding any extra cross-account transit or data processing fees. Furthermore, AWS billing assigns the cost of resources to the account that created them, meaning the Analytics account pays for the EMR compute resources, while the Shared Services account continues to pay for the Aurora database storage and instances.

Step-by-Step Solution

1
Share the private subnets in the Shared Services account VPC using AWS Resource Access Manager.
The Analytics account is granted permission to deploy resources into the specified subnets in the Shared Services VPC.
This sets up the network foundation to allow direct, private IP communication between the Analytics resources and the Shared Services database without transit costs.
2
Launch the EMR cluster from the Analytics account into the shared subnets.
EMR nodes run within the Shared Services VPC, allowing local routing to the database, while the EMR compute charges are billed directly to the Analytics account.
This satisfies the requirement to assign compute costs to the Analytics account and database costs to the Shared Services account.

Key Concept

VPC sharing via AWS Resource Access Manager (RAM) allows sharing subnets with other accounts in the same AWS Organization, facilitating secure, low-latency, and cost-effective communication while maintaining individual account billing for launched resources.
Rate this question

Topics

Billing, Cost Management, and Resource Sharing Strategy

More questions from this topic