Examkin

Question

Difficulty: MediumAWS Budgets and Cost Alerts

A company uses AWS Organizations to manage a dedicated sandbox account for trainee training. To control costs, a SysOps administrator must configure a system that automatically applies a restrictive Service Control Policy (SCP) to block new resource creation if the monthly spend on the sandbox account exceeds $1,000. Which of the following solutions will meet these requirements with the least administrative effort?

  1. Configure a monthly cost budget of $1,000 in AWS Budgets. Add a budget action targeting the sandbox account to attach the restrictive SCP when the threshold is exceeded, utilizing an IAM role that allows the budgets.amazonaws.com service principal to assume it.Answer
  2. B
    Configure an AWS Cost Anomaly Detection monitor with a threshold of $1,000. Add an anomaly subscription to automatically apply the restrictive SCP to the sandbox account using native anomaly action policies.
  3. C
    Configure a monthly cost budget of $1,000 in AWS Budgets with an SCP attachment action. Assign an IAM role to the action, and grant the administrator the iam:AssumeRole permission on the role instead of the required iam:PassRole permission.
  4. D
    Create an Amazon CloudWatch billing alarm for $1,000. Configure the alarm to directly trigger an AWS Systems Manager Automation document using a CloudWatch alarm action to attach the SCP to the sandbox account.

Answer

Configure a monthly cost budget of $1,000 in AWS Budgets. Add a budget action targeting the sandbox account to attach the restrictive SCP when the threshold is exceeded, utilizing an IAM role that allows the budgets.amazonaws.com service principal to assume it.
AWS Budgets natively supports Budgets Actions, which allows you to define automated actions to execute when a budget threshold is exceeded. These actions include applying Service Control Policies (SCPs) to AWS Organizations accounts. To enable this, an IAM role with appropriate policies must be created that trusts the 'budgets.amazonaws.com' service principal. This enables automatic and low-effort cost control compliance.

Step-by-Step Solution

1
Determine the cost-control tool that supports automated SCP attachments.
AWS Budgets native budget actions support attaching Service Control Policies (SCPs) to AWS Organizations member accounts when a threshold is crossed.
This avoids custom integration or lambda coding, minimizing administrative overhead.
2
Configure the required IAM permissions for AWS Budgets.
Create an IAM role in the Organization's management account that allows the service principal budgets.amazonaws.com to assume it, and grant the administrator creating the budget the iam:PassRole permission.
The Budgets service requires permission to assume the execution role to apply the SCP on behalf of the administrator.
3
Configure the budget and the corresponding action trigger.
Set a monthly budget of $1,000 with a budget action to apply the restrictive SCP at 100% threshold execution.
This guarantees that once the actual cost hits $1,000, the SCP is automatically applied to halt further resource creation.

Key Concept

AWS Budgets Actions with AWS Organizations Integration
Rate this question

Topics

AWS Budgets and Cost Alerts

More questions from this topic