Examkin

Question

Difficulty: Very hardBilling, Cost Management, and Resource Sharing Strategy

An enterprise is designing a multi-account AWS architecture managed under AWS Organizations with consolidated billing. The architecture consists of a Shared Services account, a Billing/Management account, and two application accounts (App-A and App-B) grouped under an Applications Organizational Unit (OU). The enterprise needs to implement a solution that satisfies the following requirements:

1. VPC subnets hosted in the Shared Services account must be shared with App-A and App-B to allow resources to be launched in a centralized network. The subnet sharing must be restricted only to accounts within the organization.
2. The enterprise has purchased a Compute Savings Plan in the Billing/Management account. The cost optimization strategy requires that App-A benefit from this Savings Plan, while App-B's volatile, non-production workloads must be excluded from absorbing the discount.
3. App-A hosts a centralized Amazon S3 bucket that must accept write operations and allow read operations from App-B. All objects in this bucket must be encrypted at rest, and the security policy dictates that App-B must have access to decrypt and write the data.

Which combination of actions will meet these requirements in the most operationally efficient and secure manner?

  1. Enable sharing within AWS Organizations in the AWS RAM console. In the Shared Services account, create a resource share in AWS RAM, associate the subnets, and share them with the Applications OU. In the Billing/Management account's Billing preferences, disable Savings Plans sharing specifically for App-B. In App-A, configure the S3 bucket to use Server-Side Encryption with a Customer Managed Key (SSE-KMS). Configure the KMS key policy to allow the App-B account's IAM roles to perform the kms:GenerateDataKey and kms:Decrypt actions, and configure the S3 bucket policy to grant read and write access to the App-B roles. In App-B, configure local IAM policies to allow access to the S3 bucket and the KMS key in App-A.Answer
  2. B
    Enable sharing within AWS Organizations in the AWS RAM console. In the Shared Services account, create a resource share in AWS RAM, associate the subnets, and share them with the Applications OU. In the Billing/Management account, purchase an EC2 Instance Savings Plan and attach an SCP to App-B that denies the savingsplans:ApplySavingsPlan action. In App-A, configure the S3 bucket to use SSE-KMS with the default AWS-managed KMS key (aws/s3). Share the S3 bucket and the KMS key with App-B using AWS RAM, and update App-B's IAM policies to allow access.
  3. C
    Create a resource share in AWS RAM in the Shared Services account, associate the subnets, and share them with App-A and App-B individually without enabling organization-wide sharing. In the Billing/Management account, configure an SCP for the Applications OU that denies the aws-portal:ViewBilling and savingsplans:PurchaseSavingsPlans actions. In App-A, configure the S3 bucket to use SSE-KMS with a Customer Managed Key. Configure the KMS key policy to allow access from App-B. In App-B, create a resource share in AWS RAM to import the KMS key from App-A, and update App-B's local IAM policies to reference the shared key.
  4. D
    Enable sharing within AWS Organizations in the AWS RAM console. In the Shared Services account, create a resource share in AWS RAM, associate the subnets, and share them with the Applications OU. In the Billing/Management account, purchase an EC2 Instance Savings Plan. In the Billing Preferences, disable Savings Plans sharing for the entire organization, and create a Billing resource tag-based rule to allocate the discount to App-A. In App-A, configure the S3 bucket to use SSE-KMS with the default AWS-managed KMS key (aws/s3). Modify the S3 bucket policy in App-A to grant the App-B root account permission, and rely on IAM policies in App-B to delegate access.

Answer

Enable AWS Organizations sharing in AWS RAM to share subnets with the Applications OU. Disable Savings Plans discount sharing specifically for App-B in the Billing preferences of the Management account. Encrypt the S3 bucket in App-A using a Customer Managed Key (CMK), configure both the S3 bucket policy and the KMS key policy to allow App-B's IAM roles to read, write, and decrypt, and configure App-B's IAM policies to allow these cross-account actions.
The correct solution uses AWS RAM integrated with AWS Organizations to share subnets directly with the Applications OU, ensuring subnet access is restricted to the organization. Selective discount sharing for Savings Plans is managed in the Billing Preferences of the management account, which allows excluding specific accounts (like App-B) from receiving the Compute Savings Plan discounts. For secure cross-account S3 access, a Customer Managed Key (CMK) must be used because its key policy can be modified to trust the external account (App-B), unlike AWS-managed keys. Both the KMS key policy and S3 bucket policy must allow access to the App-B IAM roles, and App-B's IAM policies must grant permissions to the S3 bucket and KMS key in App-A.

Step-by-Step Solution

1
Enable AWS Organizations sharing in AWS RAM and share subnets with the Applications OU.
App-A and App-B gain access to launch resources in the Shared Services VPC subnets, restricting sharing solely to the AWS Organization.
AWS RAM requires enabling integration with AWS Organizations to allow resource sharing with OUs or the entire organization.
2
Configure Billing Preferences in the Management account to disable Savings Plans sharing specifically for App-B.
The Compute Savings Plan discount purchased in the Management account is shared with App-A but is blocked from being applied to App-B's volatile workloads.
Discount sharing is a consolidated billing feature managed under Billing Preferences. Turning off sharing for specific accounts is the only supported way to exclude them from consolidated savings.
3
Create a Customer Managed Key (CMK) in App-A and configure the S3 bucket to use SSE-KMS with this key.
S3 objects are encrypted using a key whose policy can be modified to allow cross-account access.
AWS-managed keys (such as aws/s3) do not support policy modification and cannot be used for cross-account S3 decryption.
4
Configure the S3 bucket policy and the KMS key policy in App-A to grant App-B's IAM roles access, and update App-B's IAM policies.
App-B is fully authorized to write and read/decrypt objects in App-A's S3 bucket.
Cross-account access to encrypted S3 resources requires explicit permissions on the S3 bucket policy, the KMS key policy, and the caller's local IAM policy.

Key Concept

Multi-account resource sharing via AWS RAM, selective Savings Plans discount allocation, and cross-account S3 access with Customer Managed Key encryption.
Estimated Time:3m 0s
Rate this question

Topics

Billing, Cost Management, and Resource Sharing Strategy

More questions from this topic