Examkin

Question

Difficulty: HardAWS Budgets and Cost Alerts

A company uses AWS Organizations to manage multiple accounts. A SysOps administrator is configuring a monthly cost budget of 1,000foradevelopmentsandboxaccount.TheadministratorwantstosetupanAWSBudgetsactionthatwillautomaticallystopallrunningAmazonEC2instancesinthesandboxaccountassoonasthemonthlyforecastedspendisprojectedtoexceed1201,000 for a development sandbox account. The administrator wants to set up an AWS Budgets action that will automatically stop all running Amazon EC2 instances in the sandbox account as soon as the monthly forecasted spend is projected to exceed 120% ( 1,200) of the budgeted amount. Which of the following configuration steps are required to ensure the budget action executes successfully? (Select TWO.)

  1. Create an IAM role with a trust policy that allows the budgets.amazonaws.com service principal to assume the role, and attach an IAM policy to the role that allows the ec2:StopInstances and ec2:DescribeInstances actions.Answer
  2. Attach an IAM policy to the SysOps administrator's identity that grants the iam:PassRole permission for the specific execution IAM role used by the budget action.Answer
  3. C
    Create an AWS Cost Anomaly Detection monitor with a threshold of $1,200, and configure an anomaly subscription to run an automated action to stop the EC2 instances.
  4. D
    Create an Amazon CloudWatch billing alarm for estimated charges with a static threshold of $1,200, and add an EC2 action directly to the alarm to stop the running instances.

Answer

To configure the AWS Budgets action successfully, the administrator must create an IAM execution role with a trust policy allowing the budgets.amazonaws.com service principal to assume the role and permissions to stop EC2 instances, and also attach an IAM policy to the administrator's identity granting the iam:PassRole permission for the execution role.
The correct configuration requires creating an IAM role that the AWS Budgets service principal can assume to stop the EC2 instances, and granting the administrator the iam:PassRole permission to pass that role to the Budgets service. This ensures the service has the authority to execute the stop action when the forecasted threshold is exceeded.

Step-by-Step Solution

1
Identify the target action and trigger requirements.
The requirement is to automatically stop EC2 instances based on a forecasted spend of $1,200 using a native AWS Budgets action.
AWS Budgets Actions allow native integration to stop EC2 or RDS instances when actual or forecasted costs cross a defined threshold.
2
Determine the necessary IAM permissions for the AWS Budgets service principal.
AWS Budgets must be allowed to assume an IAM role that has the ec2:StopInstances and ec2:DescribeInstances permissions.
AWS Budgets requires a trust relationship with budgets.amazonaws.com to assume the execution role and run the API calls on behalf of the user.
3
Determine the user-level permissions required to associate the role with the budget action.
The SysOps administrator must possess the iam:PassRole permission targeting the execution role.
AWS enforces iam:PassRole to ensure that users cannot elevate their privileges by passing a highly privileged role to an AWS service.

Key Concept

AWS Budgets Actions configuration requirements, specifically the target execution role trust relationships and user PassRole permissions.
Estimated Time:2m 0s
Rate this question

Topics

AWS Budgets and Cost Alerts

More questions from this topic