Examkin

Question

Difficulty: HardBilling, Cost Management, and Resource Sharing Strategy

A company manages a multi-account environment under AWS Organizations. The architecture includes a Management account, a Shared Network account, a dedicated Security account, and several Application accounts grouped into distinct Organizational Units (OUs).

The company must meet the following design requirements:
- Share private subnets from a VPC in the Shared Network account with the Application accounts so they can deploy resources directly. The application teams must retain administrative control to manage their own security groups.
- Enable the Application accounts to encrypt their data at rest in Amazon S3 using a Customer Managed Key (CMK) managed within the Security account.
- Generate customized billing reports for a subsidiary's accounts under a specific OU that display public retail On-Demand pricing, while excluding the parent organization's consolidated Savings Plans and Volume Discounts.

Which TWO of the following actions should the Solutions Architect take to meet these requirements?

  1. In the Shared Network account, create a resource share using AWS Resource Access Manager (RAM) for the specific private subnets and associate it with the AWS Organization. In the Security account, create a customer managed KMS key, and configure its key policy to allow the Application accounts' root principals to perform cryptographic operations.Answer
  2. In the Management account, use AWS Billing Conductor to create a billing group containing the subsidiary's accounts. Define a pricing rule that applies public On-Demand rates and assign it to the billing group to generate pro forma billing data.Answer
  3. C
    In the Shared Network account, configure AWS RAM to share the subnets with the Application accounts' individual AWS account IDs by enabling sharing with external entities. In the Security account, use the AWS-managed KMS key for Amazon S3 (aws/s3) and update its key policy to allow cross-account access from the Application accounts.
  4. D
    In the Shared Network account, use AWS RAM to share the subnets with the Application accounts. In the Security account, create a customer managed KMS key. In the Application accounts, attach a Service Control Policy (SCP) to the OU that grants the application IAM roles permissions to modify the Security account's KMS key policy.
  5. E
    In the Billing Console of the Management account, disable Savings Plans and Reserved Instances discount sharing for the entire AWS Organization. In the subsidiary accounts, configure local IAM policies to restrict the application teams from viewing the consolidated billing dashboards.

Answer

The correct actions are to share the VPC subnets via AWS Resource Access Manager (RAM) within the AWS Organization, delegate cross-account KMS cryptographic operations using a customer managed key in the Security account, and utilize AWS Billing Conductor to apply public On-Demand pricing rules to a billing group containing the subsidiary accounts.
The correct strategy combines AWS Resource Access Manager (RAM) for subnet sharing and AWS Billing Conductor for localized pricing customization. Using RAM to share subnets within the AWS Organization allows the application accounts to deploy EC2 and ECS resources while managing their own security groups locally. For cross-account encryption, a customer managed KMS key is required because its key policy can delegate cryptographic operations to target accounts, unlike AWS-managed keys. Finally, AWS Billing Conductor is the designated service to generate pro forma bills with public retail pricing for specific billing groups without affecting actual consolidated billing invoices or disabling global savings plans sharing.

Step-by-Step Solution

1
Configure subnet sharing by creating a resource share in AWS RAM within the Shared Network account, targeting the AWS Organization or the target OUs.
Application accounts gain access to deploy resources into the shared subnets while retaining control over their local security groups.
VPC sharing isolates network management while allowing application teams to maintain their own workloads and security groups.
2
Create a customer managed KMS key in the Security account and update its key policy to delegate trust to the Application accounts' root principals.
Application accounts can now grant KMS permissions locally to their IAM roles for cross-account S3 bucket encryption.
AWS-managed KMS keys cannot be shared across accounts; only customer managed keys allow key policy modifications to delegate trust.
3
In the Management account, navigate to AWS Billing Conductor to set up a billing group containing the acquired subsidiary's accounts, create a custom pricing rule that applies public On-Demand rates, and link the pricing rule to the billing group.
Pro forma bills are generated for the subsidiary's accounts showing retail pricing, while the rest of the organization continues to benefit from consolidated discounts.
AWS Billing Conductor provides pro forma billing data modeling without affecting the actual consolidated billing invoice or global discount sharing configurations.

Key Concept

Multi-account resource sharing with AWS RAM, cross-account KMS key delegation, and billing isolation using AWS Billing Conductor.
Rate this question

Topics

Billing, Cost Management, and Resource Sharing Strategy

More questions from this topic