An enterprise is designing a multi-account architecture on AWS using AWS Organizations. The company has a central Network account that hosts shared VPCs, a Security account for consolidated compliance monitoring, and multiple application accounts across different Organizational Units (OUs) that run workloads on Amazon EC2, AWS Fargate, and AWS Lambda. The solutions architect must implement a strategy to: 1. Share specific subnets from the Network account to the application accounts automatically as new accounts are vended, minimizing manual administrative overhead. 2. Deliver AWS CloudTrail logs from all accounts to a single S3 bucket in the Security account, ensuring the logs are encrypted at rest with a key that supports cross-account decryption. 3. Optimize compute costs across EC2, Fargate, and AWS Lambda workloads across all member accounts while utilizing consolidated billing. Which of the following strategies should the solutions architect implement to meet these requirements?
- AEnable resource sharing within the organization in AWS RAM from the management account. In the Network account, create a resource share for the subnets and associate it with the application OUs. In the Security account, create an S3 bucket encrypted with the default AWS-managed KMS key for S3 (aws/s3), and configure the S3 bucket policy to allow the CloudTrail service principal to write logs. Purchase Compute Savings Plans in the management account with discount sharing enabled.
- BIn the Network account, create a resource share for the subnets and manually add the AWS account IDs of the application accounts to the share without enabling sharing within the organization in AWS RAM. In the Security account, create an S3 bucket encrypted with a Customer Managed Key (CMK), and configure both the CMK key policy and the S3 bucket policy to grant permission to the CloudTrail service principal for logging. Purchase Compute Savings Plans in the management account with discount sharing enabled.
- Enable resource sharing within the organization in AWS RAM from the management account. In the Network account, create a resource share for the subnets and associate it with the application OUs. In the Security account, create an S3 bucket encrypted with a Customer Managed Key (CMK), and configure both the CMK key policy and the S3 bucket policy to grant permission to the CloudTrail service principal for logging. Purchase Compute Savings Plans in the management account with discount sharing enabled.Cevap
- DEnable resource sharing within the organization in AWS RAM from the management account. In the Network account, create a resource share for the subnets and associate it with the application OUs. In the Security account, create an S3 bucket encrypted with a Customer Managed Key (CMK), and configure both the CMK key policy and the S3 bucket policy to grant permission to the CloudTrail service principal for logging. Purchase EC2 Instance Savings Plans in the management account with discount sharing enabled.