Examkin

Question

Difficulty: HardBilling, Cost Management, and Resource Sharing Strategy

A financial corporation manages its AWS environment through AWS Organizations. The organization has a Management account, a dedicated Security and Logging account, a Logistics account, and a Retail account. The corporation has also recently signed a contract with an external consulting firm that operates in a separate, independent AWS account.

The Solutions Architect is tasked with designing a resource sharing, security, and cost management strategy that addresses the following requirements:
1. Compute Cost Optimization: The Retail account runs a containerized microservices platform on AWS Fargate and AWS Lambda. The corporation needs to purchase Savings Plans to cover these workloads.
2. Resource Sharing: The external consulting firm’s AWS account must access a Transit Gateway hosted in the Logistics account to enable secure network connectivity.
3. Cross-Account Logging: The Logistics account must write its CloudTrail logs to a centralized S3 bucket located in the Security and Logging account. The logs must be encrypted at rest, and the Logistics account must be able to read its own logs for local auditing.
4. Billing Demarcation: For chargeback purposes, the Logistics account’s billing reports must show costs calculated at standard AWS public rates, excluding any consolidated volume discounts or organizational Savings Plans benefits.

Which architectural strategy will satisfy all of these requirements?

  1. Purchase Compute Savings Plans in the Management account. In the Logistics account, enable sharing with external principals in AWS RAM and share the Transit Gateway with the external consulting firm's account. In the Security and Logging account, configure the S3 bucket with a Customer Managed Key (CMK), and update the S3 bucket and KMS key policies to allow cross-account access for the Logistics account. In the Billing Preferences of the Management account, disable Savings Plans sharing for the Logistics account, and use AWS Billing Conductor to create a billing group for the Logistics account with a custom pricing plan that applies standard public rates.Answer
  2. B
    Purchase EC2 Instance Savings Plans in the Management account. In the Logistics account, enable sharing with external principals in AWS RAM and share the Transit Gateway with the external consulting firm's account. In the Security and Logging account, configure the S3 bucket with the AWS-managed KMS key (aws/s3), and update the S3 bucket policy to allow read/write access for the Logistics account. In the Billing Preferences of the Management account, disable Savings Plans sharing for the Logistics account, and use AWS Billing Conductor to create a billing group for the Logistics account with a custom pricing plan that applies standard public rates.
  3. C
    Purchase Compute Savings Plans in the Management account. In the Logistics account, create a resource share in AWS RAM for the Transit Gateway targeting the external consulting firm's account ID, without enabling external sharing in AWS RAM. In the Security and Logging account, configure the S3 bucket with a Customer Managed Key (CMK), and update the S3 bucket and KMS key policies to allow cross-account access. Apply a Service Control Policy (SCP) to the Logistics account's organizational unit (OU) that denies access to consolidated billing discounts to generate pro-forma billing reports.
  4. D
    Purchase Compute Savings Plans in the Management account. In the Logistics account, create a resource share in AWS RAM for the shared subnet targeting the external consulting firm's account ID, and enable external sharing in AWS RAM. In the Security and Logging account, configure the S3 bucket with the AWS-managed KMS key (aws/s3), and update the S3 bucket policy to allow read/write access. Apply a Service Control Policy (SCP) to the Logistics account's organizational unit (OU) to block volume discount inheritance, and configure billing alerts in AWS Budgets to report pro-forma costs.

Answer

The correct strategy requires purchasing Compute Savings Plans in the Management account, enabling sharing with external principals in AWS Resource Access Manager (RAM) to share the Transit Gateway, using a Customer Managed Key (CMK) with custom key policies for the centralized logging S3 bucket, and configuring AWS Billing Conductor alongside disabled Savings Plans sharing for the Logistics account to generate pro-forma billing reports using standard public rates.
The correct strategy uses Compute Savings Plans because they cover Fargate and Lambda workloads. It enables external sharing in AWS RAM to share the Transit Gateway with the external account. For the centralized logging S3 bucket, it uses a Customer Managed Key (CMK) because default AWS-managed keys cannot be shared cross-account. Finally, it uses AWS Billing Conductor combined with disabled Savings Plans sharing for the Logistics account to generate pro-forma billing reports at standard public rates.

Step-by-Step Solution

1
Determine the correct Savings Plan type for serverless container and function workloads.
Compute Savings Plans are selected.
AWS Fargate and AWS Lambda are serverless compute runtimes. They are not covered by EC2 Instance Savings Plans, which only apply to EC2 instances. Compute Savings Plans are required to cover these services.
2
Select the correct resource sharing and network mechanism for the external account.
Enable sharing with external principals in AWS RAM and share the Logistics Transit Gateway.
The external consulting firm's account is outside the AWS Organization. To share resources with external accounts via AWS RAM, the external sharing configuration must be enabled. Additionally, VPC subnets cannot be shared outside the AWS Organization, so sharing the Transit Gateway is the appropriate way to establish network connectivity.
3
Configure the cross-account encryption keys and S3 bucket access for centralized logging.
Use a Customer Managed Key (CMK) in KMS and update both the bucket policy and KMS key policy.
AWS-managed KMS keys (such as aws/s3 or aws/cloudtrail) do not support policy modifications and cannot be shared across accounts. A Customer Managed Key (CMK) must be used so that its key policy can be updated to allow the Logistics account to perform KMS operations.
4
Design the billing segregation mechanism for the Logistics account chargeback requirements.
Disable Savings Plans sharing in Billing Preferences and create a billing group in AWS Billing Conductor.
To show the Logistics account its billing data at standard public rates without organization-level discounts, Savings Plans sharing must be disabled for that specific account. AWS Billing Conductor is then used to define a custom billing group and pricing plan that applies standard public rates, generating pro-forma reports.

Key Concept

Multi-account resource sharing boundaries, KMS cross-account key policies, Compute Savings Plans applicability, and AWS Billing Conductor pro-forma reporting.
Estimated Time:3m 0s
Rate this question

Topics

Billing, Cost Management, and Resource Sharing Strategy

More questions from this topic