A global logistics enterprise has a multi-account structure managed under AWS Organizations with Consolidated Billing. The enterprise has three main OUs: Production, Development, and Shared Services. The enterprise has the following requirements:
1. Share subnets from a central VPC in the Shared Services account with the Production OU to enable direct network communication without VPC peering.
2. Purchase a Savings Plan to reduce costs for a mix of Amazon EC2, AWS Fargate, and AWS Lambda workloads running in the Production OU, while preventing these savings from being applied to the Development OU.
3. For a newly acquired subsidiary whose accounts are in a separate OU, the finance team requires a custom pro-forma billing view that applies a 5% markup on all AWS public rates.
Which two of the following options should the Solutions Architect implement to meet these requirements? (Select TWO.)
- Enable resource sharing within AWS Organizations. In the Shared Services account, create an AWS Resource Access Manager (RAM) resource share for the subnets and associate it with the Production OU. Purchase Compute Savings Plans in the Management account, and disable Savings Plans discount sharing for the Development OU in the Billing Preferences of the Management account.Cevap
- In the Management account, use AWS Billing Conductor to create a billing group with the primary account of the subsidiary as the billing group owner. Create a pricing rule with a global markup of 5%, associate this pricing rule with the billing group, and configure the billing group to generate pro forma Cost and Usage Reports (CUR).Cevap
- CEnable resource sharing within AWS Organizations. In the Shared Services account, share the subnets with the Production OU using AWS RAM. Purchase EC2 Instance Savings Plans in the Management account, and attach a Service Control Policy (SCP) to the Development OU that denies the 'savingsplans:Apply' action to restrict discount application.
- DIn the Shared Services account, create a subnet resource share in AWS RAM. Enable external sharing in the RAM console and share the subnets with the individual AWS account IDs of the Production OU. Use a default AWS-managed KMS key ('aws/s3') in the Shared Services account to encrypt all cross-account flow logs, and delegate access to the Production OU by modifying the KMS key policy.
- ECreate a billing group in AWS Billing Conductor for the subsidiary accounts. Attach an SCP to the subsidiary OU that denies access to the 'aws-portal:*' actions to enforce the 5% markup. Purchase Compute Savings Plans in the Shared Services account, and use AWS RAM to share the Savings Plan resource with the Production OU.