Examkin

Question

Difficulty: HardBilling, Cost Management, and Resource Sharing Strategy

An enterprise manages its multi-account environment using AWS Organizations. The architecture consists of a Management account, a central Network account, and multiple application accounts grouped in a Production Organizational Unit (OU). The enterprise is acquiring a subsidiary that must maintain a separate AWS Organization for compliance reasons.

The Solutions Architect must design a billing and resource sharing strategy to meet these requirements:
- Application accounts in the Production OU must deploy resources into VPC subnets managed centrally by the Network account.
- The subsidiary must access a Transit Gateway managed by the Network account of the main organization.
- Compute Savings Plans purchased in the Management account must apply to all Production accounts except for a designated testing account in the Production OU.

Which TWO of the following configurations are required to implement this strategy? (Select TWO.)

  1. In the main organization's Management account, enable resource sharing within AWS Organizations in AWS RAM. In the Network account, create a resource share containing the VPC subnets and associate it with the Production OU ID.Answer
  2. B
    In the Network account, create a resource share in AWS RAM containing the VPC subnets, enable sharing with external entities, and associate it with the acquired subsidiary's AWS account IDs.
  3. In the main organization's Management account, configure the Billing Preferences to disable Savings Plan sharing for the testing account. In the Network account, create a resource share containing the Transit Gateway, enable sharing with external entities, and associate it with the subsidiary's AWS account IDs.Answer
  4. D
    Apply a Service Control Policy (SCP) to the testing account that denies the savingsplans:ApplySavingsPlans action to prevent it from utilizing the Management account's Compute Savings Plans.

Answer

Enable resource sharing within AWS Organizations, share the VPC subnets with the Production OU, disable Savings Plan sharing for the testing account in Billing Preferences, and share the Transit Gateway externally using AWS Resource Access Manager (RAM).
The correct strategy combines enabling Organization-level sharing for internal subnet distribution and configuring Billing Preferences in the Management account to exclude specific accounts from Savings Plan sharing. It also utilizes AWS RAM's capability to share Transit Gateways externally with accounts outside the AWS Organization.

Step-by-Step Solution

1
Enable Organization-level resource sharing in the Management account using AWS RAM, then create a resource share in the Network account containing the subnets and share it with the Production OU ID.
Allows application accounts to deploy resources within the shared subnets while keeping subnet management centralized in the Network account.
VPC subnets can only be shared with accounts within the same AWS Organization.
2
In the Network account, create a resource share containing the Transit Gateway, enable sharing with external entities, and add the subsidiary's AWS account IDs.
Grants the acquired subsidiary access to the transit gateway across organizational boundaries.
Transit Gateways support cross-organization resource sharing through AWS RAM when external sharing is enabled.
3
Navigate to Billing Preferences in the main organization's Management account and turn off Savings Plan sharing for the testing account.
Excludes the testing account from receiving the shared Compute Savings Plans discounts.
Savings Plan discount sharing is managed through Billing Preferences in the Management account rather than IAM or SCPs.

Key Concept

AWS RAM sharing capabilities and limits (internal vs. external organization), and management of Savings Plans discount sharing via Billing Preferences.
Rate this question

Topics

Billing, Cost Management, and Resource Sharing Strategy

More questions from this topic