Examkin

Question

Difficulty: HardAWS Budgets and Cost Alerts

A company manages its multi-account environment using AWS Organizations. A SysOps administrator must establish a cost control policy for development sandbox accounts to prevent monthly spending from exceeding a fixed limit of $1,000\$1,000 per account. The solution must satisfy the following criteria:

1. If a sandbox account's actual monthly spend reaches 100%100\% of the budget, the account must be immediately barred from provisioning new resources.
2. A notification must be sent automatically to the SysOps team's Slack channel.

Which combination of actions should the SysOps administrator perform to meet these requirements? (Select TWO.)

  1. Configure the cost budget in the AWS Organizations management account, and define a budget action that applies a restrictive Service Control Policy (SCP) to the target member account. Ensure the IAM identity configuring the budget has iam:PassRole permissions for the role that AWS Budgets assumes.Answer
  2. Create an Amazon Simple Notification Service (Amazon SNS) topic, configure AWS Chatbot to integrate the SNS topic with the Slack channel, and configure the budget to send an alert to the SNS topic when the limit is reached.Answer
  3. C
    Configure the cost budget directly within the sandbox member account, and define a budget action that applies a local IAM policy to deny resource creation. Create an AWS Chatbot client role with sts:AssumeRole permissions in the member account to deliver the notification.
  4. D
    Configure an AWS Cost Anomaly Detection monitor with a threshold of $1,000\$1,000. Configure the monitor to trigger an AWS Systems Manager Automation document that attaches a restrictive SCP to the member account.
  5. E
    Configure the budget in the sandbox member account to publish alerts directly to the Slack webhook URL. Define a budget action that stops all running Amazon EC2 and Amazon RDS instances in the sandbox account using a local service-linked role.

Answer

Configure the cost budget in the AWS Organizations management account, defining a budget action to apply a restrictive Service Control Policy (SCP) to the target member account while ensuring the configuring IAM identity has iam:PassRole permissions; and create an Amazon SNS topic integrated with AWS Chatbot and the Slack channel to send alerts when the limit is reached.
The correct combination of actions uses AWS Budgets created in the AWS Organizations management account to trigger a native budget action. Since member accounts cannot apply SCPs to themselves, this must be done at the Organization level, requiring the administrator to have iam:PassRole permissions for the role that AWS Budgets assumes. Additionally, sending notifications to Slack is achieved by publishing alerts from AWS Budgets to an Amazon SNS topic, which triggers AWS Chatbot to deliver the message to Slack.

Step-by-Step Solution

1
Determine the budget scope and placement.
Identify that because the cost controls require applying a Service Control Policy (SCP) to block resource creation in sandbox member accounts, the budget and its action must be created in the AWS Organizations management account (or a delegated administrator account).
Member accounts do not have the permission or capability to attach SCPs to themselves.
2
Configure the Budget Action and required permissions.
Define an AWS Budgets action targeting the member account with the restrictive SCP. Attach an IAM role to the action that grants AWS Budgets permission to apply the SCP. Ensure the administrator configuring the budget has iam:PassRole permission to pass the role.
AWS Budgets must assume the specified IAM role to execute the action, and the user must be permitted to pass that role to the service.
3
Configure Slack notification integration.
Create an Amazon SNS topic and subscribe AWS Chatbot to it, mapping the subscription to the SysOps Slack channel. Set the AWS Budget alert threshold at 100%100\% of the monthly limit to publish to this SNS topic.
AWS Budgets does not support sending direct webhooks to Slack, so Amazon SNS and AWS Chatbot are required to deliver the message.

Key Concept

AWS Budgets Actions allow organization-wide enforcement (such as applying Service Control Policies) and integration with alerting mechanisms like Amazon SNS and AWS Chatbot for automated notifications.
Rate this question

Topics

AWS Budgets and Cost Alerts

More questions from this topic