An enterprise manages a multi-account environment under AWS Organizations. The environment consists of a Management account, a Security Logging account, a Shared Network account, and several Core Application accounts grouped under a Production OU, as well as Non-Production accounts under a Non-Production OU. The architecture team must implement a solution that satisfies the following requirements:
1. Network Sharing: The Shared Network account must host a central VPC. Subnets from this VPC must be shared with the Core Application accounts using AWS Resource Access Manager (RAM). The application teams must be able to deploy Amazon EC2 instances and AWS Fargate tasks into these subnets, but they must be prevented from modifying any subnet configurations or sharing resources themselves.
2. Centralized Auditing: AWS CloudTrail must be configured organization-wide to deliver logs to a single Amazon S3 bucket in the Security Logging account. The logs must be encrypted at rest using an encryption key that satisfies compliance standards requiring key rotation and granular cross-account access control.
3. Cost Optimization: The company has purchased Compute Savings Plans in the Management account. To maximize cost efficiency, these savings must only apply to workloads running in the Management account and the Production OU (Core Application accounts). Under no circumstances should the savings apply to the Non-Production OU accounts.
4. Data Protection: The S3 bucket policy in the Security Logging account must enforce that only CloudTrail can write logs, and only from within the AWS Organization.
Which of the following strategies must a Solutions Architect implement to meet these requirements?
- Implement the following configuration:
1. In the Shared Network account, create the VPC and subnets. Use AWS RAM to create a resource share containing the subnets, associate it with the Production OU, and ensure organization sharing is enabled in the AWS RAM settings. Attach a Service Control Policy (SCP) to the Production OU that denies 'ec2:DeleteSubnet', 'ec2:ModifySubnetAttribute', and 'ram:CreateResourceShare' to prevent unauthorized modifications or resource sharing.
2. In the Security Logging account, create an Amazon S3 bucket and a customer managed KMS key (CMK). Configure the S3 bucket policy to allow 's3:PutObject' from the CloudTrail service principal with a condition checking that the 'aws:PrincipalOrgID' matches the Organization ID. Configure the KMS key policy to allow 'kms:GenerateDataKey*' and 'kms:Decrypt' to the CloudTrail service principal with the same organization condition. Create an organization trail in the Management account that logs to this central bucket using the CMK.
3. In the Billing Preferences of the Management account, disable Savings Plans discount sharing for all member accounts in the Non-Production OU, while keeping discount sharing enabled for the Management account and the accounts in the Production OU.Answer - BImplement the following configuration:
1. In the Shared Network account, create the VPC and subnets. Use AWS RAM to create a resource share for the subnets and associate it with the Production OU. Attach an SCP to the Production OU that uses an Allow effect for the 'ram:AssociateResourceShare' and 'ec2:RunInstances' actions to grant the application teams the required permissions.
2. Configure an organization-wide CloudTrail trail in the Management account to deliver logs to an S3 bucket in the Security Logging account. Enable default S3 bucket encryption using the AWS managed KMS key (aws/s3) to simplify cross-account KMS key access and avoid custom key policy management.
3. Purchase EC2 Instance Savings Plans in the Management account. In the Management account's Billing Preferences, disable Savings Plans discount sharing globally, and purchase Compute Savings Plans directly in the Non-Production OU accounts, expecting the EC2 Instance Savings Plans to still apply to Fargate tasks in the Production OU. - CImplement the following configuration:
1. In the Shared Network account, create the VPC and subnets. Use AWS RAM to share the subnets with the Production OU. Attach an SCP to the Production OU that denies 'ec2:DeleteSubnet' and 'ec2:ModifySubnetAttribute'.
2. In the Security Logging account, create an S3 bucket and a customer managed KMS key (CMK). Configure the S3 bucket policy to grant write access only to the Management account's root user principal, expecting the Management account to transitively authorize CloudTrail to deliver logs from all member accounts. Configure the organization-wide CloudTrail trail to log to this bucket using the CMK.
3. Purchase EC2 Instance Savings Plans in the Management account. In the Billing Preferences of the Management account, disable Savings Plans discount sharing for the Non-Production OU accounts, expecting the EC2 Instance Savings Plans to automatically apply to the EC2 and Fargate workloads in the Production OU. - DImplement the following configuration:
1. In the Shared Network account, create the VPC and subnets. Use AWS RAM to create a resource share for the subnets, and attempt to share them with external partner accounts by specifying their AWS Account IDs, without enabling the sharing with external entities setting in the AWS RAM console settings.
2. In the Security Logging account, create an S3 bucket and a customer managed KMS key (CMK). Configure the S3 bucket policy to authorize the IAM roles of all individual application accounts to write directly to the bucket path. Configure each application account to run its own local CloudTrail trail that delivers logs to this S3 bucket using the CMK.
3. Disable consolidated billing in AWS Organizations. Purchase Compute Savings Plans in the Management account and configure cross-account IAM roles to allow production application accounts to consume the compute discounts.