Examkin

Question

Difficulty: MediumBilling, Cost Management, and Resource Sharing Strategy

A media streaming enterprise manages its multi-account environment using AWS Organizations with consolidated billing. A central Infrastructure account hosts a shared VPC. The solutions architect must enable several Production Application accounts to deploy Amazon ECS tasks within the private subnets of this shared VPC. The architect must also ensure that the Production Application accounts cannot view, create, or modify network configurations such as Route Tables or Network ACLs. Additionally, the enterprise has purchased Savings Plans in the Management account. These Savings Plans discounts must apply to all Production Application accounts, but must not apply to a designated Test account. Which architectural and billing strategy should the solutions architect implement?

  1. In the Infrastructure account, use AWS Resource Access Manager (RAM) to share the private subnets with the Production Application accounts. In the AWS Billing console of the Management account, disable Savings Plan discount sharing for the Test account.Answer
  2. B
    In the Infrastructure account, use AWS Resource Access Manager (RAM) to share the entire VPC with the Production Application accounts. In the AWS Billing console of the Management account, disable Savings Plan discount sharing for the Test account.
  3. C
    In the Infrastructure account, use AWS Resource Access Manager (RAM) to share the private subnets with the Production Application accounts. Apply a Service Control Policy (SCP) to the Test account's Organizational Unit (OU) that denies the savingsplans:ApplySavingsPlans action.
  4. D
    Deploy VPC peering connections between the Infrastructure VPC and the Production Application VPCs. In the AWS Billing console of the Infrastructure account, disable Savings Plan discount sharing for the Test account.

Answer

In the Infrastructure account, use AWS Resource Access Manager (RAM) to share the private subnets with the Production Application accounts. In the AWS Billing console of the Management account, disable Savings Plan discount sharing for the Test account.
The correct strategy uses AWS Resource Access Manager (RAM) in the Infrastructure account to share subnets with the Production Application accounts. This allows them to run workloads without having visibility or control over VPC routing and security configurations. To selectively exclude the Test account from the consolidated Savings Plans benefit, the architect must disable Savings Plan discount sharing for the Test account within the AWS Billing preferences of the Organizations Management account.

Step-by-Step Solution

1
Evaluate the sharing mechanism for VPC resources.
Identify that AWS Resource Access Manager (RAM) supports sharing VPC subnets, but not the entire VPC resource. Sharing subnets restricts resource management permissions in member accounts, meaning they can launch resources but cannot modify VPC route tables, internet gateways, or network ACLs.
This satisfies the requirement to allow resource deployment while restricting control over the network configuration.
2
Determine the control plane for billing discount sharing.
Confirm that Savings Plans discounts are shared across accounts under AWS Organizations by default, and this preference can only be modified from the Management (payer) account billing preferences console.
Only the Management account has administrative control over consolidated billing features and discount distribution preferences.
3
Assess the capabilities of Service Control Policies (SCPs) regarding billing.
Recognize that SCPs restrict API actions, but do not affect consolidated billing discount distribution rules.
This rules out using SCPs to deny the application of Savings Plans discounts.

Key Concept

AWS VPC sharing via RAM allows secure multi-tenant network partitioning, while Savings Plans discount sharing preferences must be managed in the Organizations Management account.
Rate this question

Topics

Billing, Cost Management, and Resource Sharing Strategy

More questions from this topic