An enterprise manages a multi-account AWS environment under an organization in AWS Organiz… — AWS Certified Solutions Architect - Professional

An enterprise manages a multi-account AWS environment under an organization in AWS Organizations with consolidated billing enabled. The environment comprises the following workloads:

* Account A (Web Portal): Runs a critical web application $24/7$ on Amazon EC2 `m6i.large` instances ( $2\text{ vCPUs}$ , $8\text{ GiB}$ memory) behind an Application Load Balancer. CloudWatch metrics indicate that average CPU utilization is consistently below $15\%$ , and peak memory utilization never exceeds $3.2\text{ GiB}$ .
* Account B (Video Processing): Runs dynamic video transcoding jobs on AWS Fargate (configured with task allocations equivalent to `c6g.large`) and triggers AWS Lambda functions for metadata extraction. This workload is highly variable and spikey.
* Account C (Analytics): Runs an Amazon RDS for PostgreSQL database instance (`db.r6g.xlarge`, $4\text{ vCPUs}$ , $32\text{ GiB}$ memory) with an average CPU utilization of $8\%$ , and freeable memory consistently around $26\text{ GiB}$ . It also runs several Amazon EC2 `r6g.xlarge` instances for ad-hoc business intelligence reporting, which are active only on weekdays from 9:00 AM to 5:00 PM.

Currently, both Account A and Account B route all outbound traffic to public Amazon S3 and DynamoDB endpoints through a single NAT Gateway deployed in a single Availability Zone (AZ) within their respective VPCs to minimize hourly fees.

The company wants to optimize costs across all accounts while maintaining high availability (HA) for all workloads and minimizing operational overhead. Which of the following solutions represents the most cost-effective and architecturally sound optimization strategy?

A
Right-size the EC2 instances in Account A to `m6i.medium` and the RDS database in Account C to `db.r6g.large`. Deploy Gateway VPC Endpoints for Amazon S3 and DynamoDB, and configure a NAT Gateway in each utilized Availability Zone. Purchase an EC2 Instance Savings Plan at the organization's management account level covering the `m6i` and `r6g` instance families across all accounts, and keep Account C's EC2 instances running 24/7 to fully utilize the committed capacity.
B
Retain the EC2 instances in Account A as `m6i.large` and the RDS database in Account C as `db.r6g.xlarge` to prevent performance risks. Keep the single NAT Gateway in each VPC in Account A and Account B to minimize hourly charges, while routing Amazon S3 and DynamoDB traffic through Gateway VPC Endpoints. Implement AWS Instance Scheduler to shut down Account C's EC2 instances outside of business hours, and purchase a Compute Savings Plan at the management account level to cover all active workloads.
Right-size the EC2 instances in Account A to `m6i.medium` and the RDS database in Account C to `db.r6g.large`. Deploy Gateway VPC Endpoints for Amazon S3 and DynamoDB in the VPCs of Account A and Account B, and configure a NAT Gateway in each utilized Availability Zone. Implement AWS Instance Scheduler to shut down Account C's EC2 instances outside of business hours. Purchase a Compute Savings Plan at the organization's management account level to cover the right-sized 24/7 EC2 instances, Fargate tasks, and Lambda functions.Answer
D
Right-size the EC2 instances in Account A to `m6i.medium` and the RDS database in Account C to `db.r6g.large`. Consolidate the VPCs of Account A and Account B into a single shared VPC, sharing subnets using AWS Resource Access Manager (RAM) without enabling resource sharing within AWS Organizations. Deploy a single NAT Gateway in the shared VPC to minimize costs, configure Gateway VPC Endpoints for S3 and DynamoDB, and purchase a Compute Savings Plan at the management account level.

Answer

Right-size the EC2 instances in Account A to `m6i.medium` and the RDS database in Account C to `db.r6g.large`. Deploy Gateway VPC Endpoints for Amazon S3 and DynamoDB in the VPCs of Account A and Account B, and configure a NAT Gateway in each utilized Availability Zone. Implement AWS Instance Scheduler to shut down Account C's EC2 instances outside of business hours. Purchase a Compute Savings Plan at the organization's management account level to cover the right-sized 24/7 EC2 instances, Fargate tasks, and Lambda functions.

The correct solution right-sizes the underutilized instances based on the monitored metrics (halving the size of the EC2 instances in Account A and the RDS instance in Account C). It replaces the single NAT Gateway bottleneck with Gateway VPC Endpoints for S3 and DynamoDB to eliminate data transfer charges for those high-volume services, while deploying multi-AZ NAT Gateways to ensure high availability for remaining internet-bound traffic. It uses AWS Instance Scheduler to shut down the reporting EC2 instances in Account C when they are not in use, which yields greater savings than running them 24/7 under a Savings Plan. Finally, purchasing a Compute Savings Plan at the management account level allows the discount to apply flexibly across EC2, Fargate, and Lambda workloads across all member accounts.

Step-by-Step Solution

Analyze CloudWatch utilization metrics to identify right-sizing opportunities.

Determine that Account A's EC2 instances can be downsized from `m6i.large` to `m6i.medium` (since CPU

< 15\%

and memory

\leq 3.2\text{ GiB}

), and Account C's RDS database can be downsized from `db.r6g.xlarge` to `db.r6g.large` (since CPU is

8\%

and freeable memory is

26\text{ GiB}

Right-sizing directly reduces the on-demand cost by

50\%

for these resources before applying any commitment discounts.

Evaluate the cost and availability configuration of the NAT Gateways and endpoints.

Deploy Gateway VPC Endpoints for S3 and DynamoDB to route traffic locally and avoid NAT Gateway processing fees. Add a NAT Gateway per Availability Zone to remove the single point of failure for remaining internet traffic.

Gateway VPC endpoints are free and eliminate data transfer costs to S3/DynamoDB, while multi-AZ NAT Gateways satisfy the high availability requirement.

Evaluate the utilization schedule for the ad-hoc reporting instances in Account C.

Determine that the instances are active only

40

hours per week (

24\%

of the week). Shutting them down outside of business hours using AWS Instance Scheduler saves approximately

76\%

of the instance cost.

Stopping the instances provides greater savings than keeping them running 24/7 under any Savings Plan discount.

Determine the appropriate Savings Plan type to cover the remaining predictable workloads across accounts.

Purchase a Compute Savings Plan at the Organization management account level.

Compute Savings Plans apply flexibly across EC2, Fargate, and Lambda workloads regardless of region, instance family, or size, and consolidated billing automatically shares the benefit across all member accounts.

Key Concept

Combining right-sizing, scheduling for transient workloads, Gateway VPC endpoints for S3/DynamoDB to eliminate NAT costs, multi-AZ NAT Gateways for high availability, and Compute Savings Plans for heterogeneous/serverless compute workloads across a multi-account AWS Organization.

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic