An enterprise-scale organization has structured its AWS multi-account environment with a management account, a core infrastructure account, and multiple Developer and Production member accounts under corresponding Organizational Units (OUs). The Solutions Architect is tasked with implementing a resource sharing, billing optimization, and security audit logging design under the following conditions:
1. Network subnets from the core infrastructure account must be shared with the Production OU to enable decentralized resource deployment, while preventing any resource sharing with external AWS accounts.
2. The organization has purchased a $100/hour Compute Savings Plan at the management account level. To keep development costs representative of standard rates, this Savings Plan's discount must not be applied to any accounts under the Developer OU.
3. AWS CloudTrail logs from all accounts must be stored in a central Amazon S3 bucket within a dedicated Security account. The logs must be encrypted at rest using a key that supports auditing and cross-account policy management.
Which two actions should the Solutions Architect take to meet these requirements? (Select TWO.)
- Enable resource sharing within AWS Organizations in AWS Resource Access Manager (RAM). In the core infrastructure account, create a resource share for the subnets and share them with the Production OU. In the Management account's Billing Preferences, disable Savings Plans discount sharing for the member accounts under the Developer OU.Answer
- In the Security account, create an Amazon S3 bucket encrypted by default with an AWS KMS Customer Managed Key (CMK). Configure the S3 bucket policy to permit the s3:PutObject action from the AWS Organization ID, and modify the CMK key policy to allow the CloudTrail service principal to perform kms:GenerateDataKey* operations.Answer
- CEnable resource sharing within AWS Organizations in AWS RAM. In the core infrastructure account, create a resource share for the subnets and share them with the Production OU. Apply a Service Control Policy (SCP) to the Developer OU that contains a deny statement for the savingsplans:ApplySavingsPlan action.
- DIn the Security account, create an Amazon S3 bucket encrypted by default with the AWS-managed KMS key (aws/s3). Configure the S3 bucket policy to permit the s3:PutObject action from the AWS Organization ID, and require secure transport (HTTPS) for all write requests.
- EEnable resource sharing with external entities in AWS RAM. In the core infrastructure account, create a resource share for the subnets and share them individually with the account IDs in the Production OU. In the Management account, create an AWS Billing Conductor billing group for the Developer OU and assign a custom pricing rule that excludes Savings Plans.