Examkin

Question

Difficulty: MediumBilling, Cost Management, and Resource Sharing Strategy

A company is designing a multi-account architecture using AWS Organizations. A central Network account manages a shared VPC and wants to share specific subnets with multiple Application accounts using AWS Resource Access Manager (RAM). The security team requires all Amazon Elastic Block Store (EBS) volumes created by the Application accounts inside these shared subnets to be encrypted using a central key managed in a dedicated Security account. Which strategy should the Solutions Architect implement to meet these requirements?

  1. A
    Configure AWS RAM to share the subnets with the AWS Organization. In the Security account, use the default AWS-managed key for EBS (aws/ebs) and update its key policy to allow cross-account access for the Application accounts. In the Application accounts, configure EBS encryption to reference the Security account's aws/ebs key ARN.
  2. B
    Enable resource sharing with external entities in AWS RAM, and share the subnets with the Application account IDs individually without enabling AWS Organizations integration. In the Security account, create a Customer Managed Key (CMK) and configure its key policy to grant the Application accounts access to the key.
  3. Configure AWS RAM to share the subnets with the AWS Organization. In the Security account, create a Customer Managed Key (CMK), and update its key policy to grant the Application accounts' IAM roles and EC2 service-linked roles permission to use the key. In the Application accounts, configure EBS encryption to use this shared CMK.Answer
  4. D
    Configure AWS RAM to share the subnets with the AWS Organization. Attach a Service Control Policy (SCP) at the organization's root level that grants the Application accounts access to the default AWS-managed key (aws/ebs) located in the Security account.

Answer

Configure AWS Resource Access Manager (RAM) to share subnets with the organization, create a Customer Managed Key (CMK) in the Security account, update the CMK key policy to allow the Application accounts' IAM roles and service-linked roles access, and configure EBS encryption in the Application accounts to use the shared CMK.
The correct strategy is to share the subnets within the AWS Organization using AWS RAM and use a Customer Managed Key (CMK) in the Security account. Since VPC subnets can only be shared inside an AWS Organization and AWS-managed keys cannot be shared cross-account, a CMK must be used with a key policy that allows the application accounts' IAM roles and EC2 service-linked roles to use it.

Step-by-Step Solution

1
Evaluate subnet sharing capability using AWS Resource Access Manager (RAM).
Confirm that VPC subnets can only be shared with accounts within the same AWS Organization, requiring AWS Organizations integration to be enabled for RAM.
This determines the valid sharing boundary for VPC subnets via AWS RAM.
2
Determine the appropriate KMS key type for cross-account EBS encryption.
Identify that AWS-managed KMS keys (like aws/ebs) cannot be shared across accounts. A Customer Managed Key (CMK) is required in the Security account.
Only Customer Managed Keys support key policy modification to allow cross-account access.
3
Configure the key policy for the Customer Managed Key in the Security account.
Grant permission for the Application accounts' IAM roles and EC2 service-linked roles to use the CMK.
This allows the Application accounts' EC2 instances to perform cryptographic operations (encrypt and decrypt) on the EBS volumes using the key in the Security account.
4
Configure EBS encryption settings in the Application accounts.
Set the default EBS encryption key in the Application accounts to point to the shared CMK ARN from the Security account.
This ensures all newly created EBS volumes in the shared subnets are automatically encrypted with the centralized key.

Key Concept

Cross-account resource sharing with AWS RAM and Customer Managed Keys (CMKs)
Rate this question

Topics

Billing, Cost Management, and Resource Sharing Strategy

More questions from this topic