Examkin

Question

Difficulty: MediumBilling, Cost Management, and Resource Sharing Strategy

A digital media startup is setting up its AWS multi-account environment using AWS Organizations. The environment consists of a management account, a core networking account, a production workload account, and a development account. The startup has the following requirements:
1. Private subnets created in the core networking account must be shared with the production and development accounts to deploy application resources.
2. Database instances in the production account must be encrypted using an AWS KMS key that can be centrally managed and audited by the security team in the core account.
3. Compute Savings Plans discounts must be applied exclusively to the production account's workloads (which consist of a mix of Amazon EC2 and AWS Fargate) without being consumed by the development account's resources.

Which strategy should a solutions architect recommend to satisfy these requirements?

  1. Enable resource sharing with AWS Organizations in the AWS Resource Access Manager (RAM) settings. Create a resource share in the core networking account for the private subnets, and associate it with the production and development accounts. Create a Customer Managed Key (CMK) in the core account, and configure its key policy to allow the production account to use the key for cryptographic operations. In the Billing Preferences of the management account, turn off Savings Plans discount sharing, and then purchase the Compute Savings Plans directly in the production account.Answer
  2. B
    Enable resource sharing with AWS Organizations in the AWS Resource Access Manager (RAM) settings. Create a resource share in the core networking account for the private subnets, and associate it with the production and development accounts. Configure encryption on the database instances in the production account using the default AWS-managed KMS key for Amazon RDS (aws/rds), and update the default key policy to trust the production account. In the Billing Preferences of the management account, turn off Savings Plans discount sharing, and then purchase the Compute Savings Plans directly in the production account.
  3. C
    Enable resource sharing with AWS Organizations in the AWS Resource Access Manager (RAM) settings. Create a resource share in the core networking account for the private subnets, and associate it with the production and development accounts. Create a Customer Managed Key (CMK) in the core account, and configure its key policy to allow the production account to use the key for cryptographic operations. Purchase EC2 Instance Savings Plans in the management account, and use Service Control Policies (SCPs) to block the development account from utilizing the savings benefits.
  4. D
    Create a resource share in the AWS Resource Access Manager (RAM) console of the core networking account for the private subnets, and associate it with the production and development accounts, without enabling organization-wide sharing in the AWS RAM settings. Create a Customer Managed Key (CMK) in the core account, and configure its key policy to allow the production account to use the key. In the Billing Preferences of the management account, turn off Savings Plans discount sharing, and then purchase the Compute Savings Plans directly in the production account.

Answer

To meet all requirements, the solutions architect must enable sharing with AWS Organizations in AWS RAM and share the subnets, use a Customer Managed Key (CMK) in the core account and modify its key policy for cross-account access, and disable Savings Plans discount sharing in the management account while purchasing Compute Savings Plans directly in the production workload account.
The correct strategy involves enabling AWS Organizations sharing in AWS RAM to distribute subnets, using a Customer Managed Key (CMK) with cross-account permissions for secure key management, and turning off Savings Plans discount sharing in the management account while purchasing Compute Savings Plans directly in the production account to restrict the discount application.

Step-by-Step Solution

1
Enable organization sharing in AWS Resource Access Manager (RAM) and share the subnets.
Allows subnets from the core networking account to be shared and accessed by the production and development accounts.
By default, AWS RAM cannot share resources within the Organization unless organization-wide sharing is enabled in the RAM settings.
2
Create a Customer Managed Key (CMK) and grant cross-account key permissions.
Enables the production account to use the KMS key in the core account for database encryption.
AWS-managed keys (like aws/rds) cannot be shared or modified. A customer managed key must be used to delegate cross-account permissions via its key policy.
3
Disable Savings Plans sharing in the management account and purchase Compute Savings Plans in the production account.
Ensures that the Savings Plans discounts apply only to the production account's workloads (EC2 and Fargate) and are not consumed by the development account's resources.
Disabling discount sharing at the management account level localizes the discount benefits to the specific account that purchased the Savings Plan. Compute Savings Plans are required to cover both EC2 and Fargate.

Key Concept

Multi-account resource sharing, cross-account KMS key access delegation, and selective application of AWS Savings Plans discounts.
Rate this question

Topics

Billing, Cost Management, and Resource Sharing Strategy

More questions from this topic