Examkin

Question

Difficulty: MediumBilling, Cost Management, and Resource Sharing Strategy

A financial services organization is designing the resource sharing and cost optimization strategy for its AWS multi-account landing zone. The core infrastructure includes a Shared-Network account, a Central-Compliance account, and several Business-Unit accounts. The Shared-Network account contains a VPC with private subnets. The application workloads in the Business-Unit accounts must be deployed within these shared subnets to avoid duplicate NAT Gateway charges, and they must write encrypted transaction logs to a centralized S3 bucket located in the Central-Compliance account. Which of the following strategies should a solutions architect implement to satisfy these requirements securely?

  1. Enable resource sharing within AWS Organizations. Use AWS Resource Access Manager (RAM) in the Shared-Network account to share the private subnets with the Business-Unit accounts. Create a Customer Managed Key (CMK) in the Central-Compliance account to encrypt the S3 bucket. Configure the S3 bucket policy to grant write access to the application IAM roles, and update the CMK key policy in the Central-Compliance account to allow the application IAM roles to perform kms:GenerateDataKey and kms:Decrypt operations.Answer
  2. B
    Enable resource sharing within AWS Organizations. Use AWS Resource Access Manager (RAM) in the Shared-Network account to share the private subnets with the Business-Unit accounts. Use the AWS-managed KMS key (aws/s3) to encrypt the S3 bucket in the Central-Compliance account. Configure the S3 bucket policy to grant write access to the application IAM roles, and add a policy statement to the aws/s3 key policy allowing the application IAM roles cross-account access to use the key.
  3. C
    Enable resource sharing within AWS Organizations. Use AWS Resource Access Manager (RAM) in the Shared-Network account to share the private subnets with the Business-Unit accounts. Create a Customer Managed Key (CMK) in the Central-Compliance account to encrypt the S3 bucket. Attach a Service Control Policy (SCP) to the Business-Unit OU that explicitly allows s3:PutObject and kms:GenerateDataKey on the central logging resources, without configuring S3 bucket policies or KMS key policies.
  4. D
    Enable resource sharing within AWS Organizations. Use AWS Resource Access Manager (RAM) in the Shared-Network account to share the private subnets with the Business-Unit accounts. Create a Customer Managed Key (CMK) in the Central-Compliance account to encrypt the S3 bucket. Configure the IAM roles in the Business-Unit accounts to allow S3 and KMS actions, but do not configure an S3 bucket policy in the Central-Compliance account, relying instead on S3 Access Control Lists (ACLs) with bucket owner preferred settings to automatically grant write permissions.

Answer

Enable resource sharing within AWS Organizations, share the subnets via AWS Resource Access Manager (RAM), use a Customer Managed Key (CMK) for encryption, and configure both the S3 bucket policy and the CMK key policy to allow cross-account access for the application IAM roles.
The correct strategy uses AWS RAM to share the VPC subnets from the Network account to the Business-Unit accounts, avoiding additional NAT Gateway costs. It relies on a Customer Managed Key (CMK) rather than an AWS-managed KMS key since CMK policies can be modified to grant cross-account access. Finally, it explicitly grants the required S3 and KMS permissions via the S3 bucket policy and KMS key policy respectively to the application IAM roles.

Step-by-Step Solution

1
Enable resource sharing at the AWS Organizations level and use AWS RAM in the Shared-Network account to share the VPC subnets with the Business-Unit accounts.
The application instances can be launched in the shared subnets, utilizing the existing NAT Gateways in the Shared-Network VPC, thereby avoiding duplicate NAT Gateway deployment costs.
This establishes the shared networking topology according to the organization's cost optimization goals.
2
Create a Customer Managed Key (CMK) in the Central-Compliance account instead of relying on the AWS-managed key.
A key is provisioned whose policy can be edited to delegate permissions to principals in other AWS accounts.
AWS-managed keys (aws/s3) cannot be shared or configured with custom resource policies to allow cross-account operations.
3
Configure the S3 bucket policy in the Central-Compliance account to allow s3:PutObject actions from the application IAM roles in the Business-Unit accounts.
The application workloads obtain resource-side permission to write to the centralized bucket.
Cross-account S3 writes require explicit permission in the destination bucket's policy.
4
Configure the CMK key policy in the Central-Compliance account to allow the application IAM roles to perform kms:GenerateDataKey and kms:Decrypt.
The application instances can successfully request a data key from KMS to encrypt the log objects before uploading them to S3.
Since the bucket is encrypted using a Customer Managed KMS Key, write operations require kms:GenerateDataKey permissions on the key.

Key Concept

Cross-account resource sharing and access control using AWS RAM, S3 bucket policies, and Customer Managed KMS Keys.
Estimated Time:2m 0s
Rate this question

Topics

Billing, Cost Management, and Resource Sharing Strategy

More questions from this topic