Examkin

Question

Difficulty: Very hardBilling, Cost Management, and Resource Sharing Strategy

An enterprise manages its multi-account environment using AWS Organizations. The organization consists of Production, Development, and Sandbox OUs, along with dedicated Shared Services and Security accounts. The billing department has specified that the Sandbox accounts, which are leased to a third-party contractor, must receive customized pro-forma billing reports showing a 10%10\% markup on AWS list prices instead of the enterprise's negotiated rates. Additionally, the contractor's Sandbox accounts must be excluded from benefiting from the enterprise's Compute Savings Plans. For network optimization, VPC subnets from the Shared Services account must be shared with the Production and Development accounts, but not the Sandbox accounts. Developers in the Production and Development accounts must be able to launch Amazon EC2 instances with encrypted EBS volumes using a Customer Managed Key (CMK) managed in the central Security account.

Which TWO of the following solutions should the Solutions Architect implement to meet these requirements?

  1. Create a billing group in AWS Billing Conductor with the Sandbox accounts as members. Define a custom pricing plan with a markup rate of 10%10\% and associate it with this billing group. In the Billing Preferences of the Management account, disable Savings Plans discount sharing for the Sandbox accounts.Answer
  2. Share the subnets from the Shared Services account to the Production and Development OUs using AWS Resource Access Manager (RAM). In the Security account, create a KMS Customer Managed Key (CMK) and configure its key policy to allow the IAM roles and EC2 service-linked roles in the application accounts to perform kms:CreateGrant and kms:Decrypt operations.Answer
  3. C
    Enable AWS Organizations integration in AWS Resource Access Manager (RAM). Share the subnets from the Shared Services account with the Sandbox OU. In the Management account, write a Service Control Policy (SCP) that denies savingsplans:Apply or savingsplans:Share actions, and attach it to the Sandbox OU.
  4. D
    To share the custom billing views, configure AWS Cost Categories in the Management account to apply a 10%10\% chargeback rule to the Sandbox OU. To manage EBS encryption, use the default AWS-managed KMS key (aws/ebs) in the Security account and update its policy to permit cross-account decrypt operations for the application accounts.
  5. E
    Register the Sandbox accounts in AWS Resource Access Manager (RAM) by enabling external sharing, and share the VPC subnets with them. Purchase EC2 Instance Savings Plans in the Management account and use AWS Budgets to dynamically exclude the Sandbox OU from discount sharing.

Answer

The correct strategy requires configuring AWS Billing Conductor for pro-forma billing with markup, disabling Savings Plans discount sharing for Sandbox accounts in Billing Preferences, sharing the subnets with the Production and Development OUs via AWS RAM, and sharing a Customer Managed Key from the Security account with the application accounts with permissions to create grants and decrypt.
The correct solution correctly combines AWS Billing Conductor (to model custom pricing and generate pro-forma invoices with markups) and the Billing Preferences console (to turn off Savings Plans discount sharing for designated accounts). It also utilizes AWS Resource Access Manager (RAM) to target the specific OUs (Production and Development) for subnet sharing. For cross-account KMS encryption of EBS volumes, a Customer Managed Key is used, which allows cross-account delegation via key policy, granting the necessary decrypt and grant creation permissions to the app accounts' roles.

Step-by-Step Solution

1
Identify the billing and cost management mechanism to generate custom pricing plans (pro-forma bills) for Sandbox accounts.
Use AWS Billing Conductor to define a billing group containing the Sandbox accounts and apply a pricing plan with a 10%10\% markup.
This generates customized reports showing a markup on AWS list prices without altering actual billing.
2
Configure Savings Plans sharing exclusion.
Navigate to Billing Preferences in the Management account and disable discount sharing for the Sandbox accounts.
This prevents the contractor's accounts from consuming the organization's Compute Savings Plans.
3
Set up secure resource sharing.
Share the subnets from the Shared Services account to the Production and Development OUs using AWS Resource Access Manager (RAM). Do not share these resources with the Sandbox accounts or OUs.
This allows the application accounts to run instances in shared subnets while isolating the Sandbox environment.
4
Configure cross-account KMS key sharing for EC2 EBS encryption.
Create a Customer Managed Key (CMK) in the Security account and update the key policy to grant the application accounts' IAM roles and the EC2 service-linked roles the rights to perform kms:Decrypt and kms:CreateGrant.
This allows EC2 to create a grant on the key to attach and decrypt the volume under the service-linked role.

Key Concept

Consolidated billing customization, Savings Plans discount sharing configuration, AWS Resource Access Manager (RAM) subnet sharing, and cross-account Customer Managed Key policy permissions.
Estimated Time:3m 0s
Rate this question

Topics

Billing, Cost Management, and Resource Sharing Strategy

More questions from this topic