A multinational corporation uses AWS Organizations to manage a multi-account environment. The organization consists of a Management account, a central Shared Services account, a Production Organizational Unit (OU) containing several application accounts, and a Development OU containing several testing accounts.
The corporation wants to implement a cost optimization and resource sharing architecture with the following requirements:
* A set of VPC subnets created in the Shared Services account must be shared with all application and testing accounts to enable standardized network routing.
* The finance team has purchased a Compute Savings Plan in the Management account. The discount benefits must be applied to the accounts in the Production OU first, but must be completely blocked from applying to any accounts in the Development OU to ensure development teams pay standard On-Demand rates for budgeting.
* The AWS Cost and Usage Report (CUR) is written to an Amazon S3 bucket in the Shared Services account. Data analysts in the application and testing accounts must run Amazon Athena queries in their local accounts to read this billing data directly. The S3 bucket must be encrypted at rest, and the architecture must support secure cross-account queries.
Which combination of actions will meet these requirements?
- Configure AWS Resource Access Manager (RAM) in the Shared Services account to share the subnets, enabling organization sharing and selecting the Production and Development OUs as principals. In the AWS Billing console of the Management account, enable discount sharing, but selectively turn off Reserved Instance (RI) and Savings Plans (SP) sharing for all individual accounts in the Development OU. Encrypt the S3 bucket in the Shared Services account using a Customer Managed Key (CMK) in AWS KMS, configure the KMS key policy to allow the IAM roles in the application and testing accounts to perform kms:Decrypt and kms:GenerateDataKey, and update the S3 bucket policy to grant s3:GetObject and s3:ListBucket permissions to those cross-account roles.Answer
- BConfigure AWS Resource Access Manager (RAM) in the Shared Services account to share the subnets, selecting the Production and Development OUs as principals. Attach a Service Control Policy (SCP) to the Development OU that denies the savingsplans:Apply and savingsplans:Purchase actions to prevent development accounts from utilizing the Management account's Savings Plan. Encrypt the S3 bucket in the Shared Services account using the AWS managed key (aws/s3), and configure the S3 bucket policy to grant s3:GetObject and s3:ListBucket permissions to the IAM roles in the application and testing accounts.
- CEnable subnet sharing by attaching a resource-based IAM policy to the VPC subnets in the Shared Services account that allows access from the application and testing accounts. In the AWS Billing console of the Management account, turn off discount sharing globally, and write a custom billing rule in AWS Billing Conductor to manually allocate the Compute Savings Plan discounts to the Production OU accounts. Encrypt the S3 bucket in the Shared Services account using a Customer Managed Key (CMK) in AWS KMS, configure the KMS key policy to trust the application and testing accounts, and rely on local IAM permissions for cross-account S3 access without modifying the S3 bucket policy.
- DConfigure AWS Resource Access Manager (RAM) in the Shared Services account to share the subnets. Do not enable sharing within AWS Organizations; instead, send individual RAM resource share invitations to each account in the Production and Development OUs. In the AWS Billing console of the Management account, disable discount sharing globally. Have each production account purchase its own local Savings Plan, while keeping development accounts on On-Demand. Encrypt the Shared Services S3 bucket using the AWS managed key (aws/s3) and create a cross-account IAM role in the Shared Services account that application and testing accounts must assume to execute their Athena queries.