Examkin

Soru

Zorluk: ZorBilling, Cost Management, and Resource Sharing Strategy

An enterprise is designing a multi-account strategy using AWS Organizations. The architecture consists of a management account, a shared network account, a centralized security logging account, and multiple application accounts organized into a Developer Organizational Unit (OU). The Solutions Architect must implement the following requirements:

1. Share VPC subnets created in the shared network account with the Developer OU to enable application deployment.
2. Capture VPC Flow Logs from the shared subnets and centralize them into an Amazon S3 bucket in the security logging account. The log files must be encrypted at rest using an AWS KMS key.
3. Maximize cost savings across the organization's compute portfolio, which includes Amazon EC2 instances, AWS Fargate tasks, and AWS Lambda functions.

Which combination of actions should the Solutions Architect take to meet these requirements securely and efficiently? (Select TWO.)

  1. Enable resource sharing with AWS Organizations in AWS RAM from the management account. In the shared network account, create a resource share for the subnets and associate it with the Developer OU. In the management account, purchase Compute Savings Plans with sharing enabled to cover compute usage across all member accounts.Cevap
  2. B
    Purchase EC2 Instance Savings Plans in the management account to cover the EC2 instances, Fargate tasks, and Lambda functions. In the shared network account, configure AWS RAM to share the subnets directly with application accounts. Attach a Service Control Policy (SCP) to the Developer OU to grant application instances the permission to launch in the shared subnets.
  3. In the security logging account, create an Amazon S3 bucket with a bucket policy that grants s3:PutObject permissions to the delivery.logs.amazonaws.com service principal. Create a symmetric customer managed key (CMK) in AWS KMS with a key policy allowing the delivery.logs.amazonaws.com service principal to use the kms:GenerateDataKey* and kms:Decrypt actions, and configure VPC Flow Logs to use this CMK and target the bucket.Cevap
  4. D
    Configure the S3 bucket in the security logging account to use the default AWS-managed KMS key (aws/s3) for encryption. Modify the key policy of aws/s3 to allow the VPC Flow Logs service principal (delivery.logs.amazonaws.com) from the shared network account to access the key, and configure cross-account access policies.
  5. E
    In the shared network account, create a resource share in AWS RAM for the subnets, enable external sharing, and invite each application account's root email address. Create an S3 bucket in the security logging account with a bucket policy that permits general read and write access, restricting access only by a source IP address range condition matching the VPC CIDRs.

Cevap

The correct strategy requires enabling AWS RAM sharing with AWS Organizations to share subnets with the Developer OU, purchasing Compute Savings Plans in the management account to cover EC2, Fargate, and Lambda, and creating an S3 bucket in the security logging account alongside a symmetric customer managed key (CMK) with key and bucket policies that grant access to the delivery.logs.amazonaws.com service principal.
The correct strategy combines two actions. First, enabling AWS Organizations support in AWS RAM allows the subnets to be shared with the Developer OU. Purchasing Compute Savings Plans covers the EC2, Fargate, and Lambda instances across the entire organization. Second, to encrypt and store cross-account VPC Flow Logs in the security logging account, a Customer Managed Key (CMK) is required because AWS-managed KMS keys cannot be shared cross-account or have their policies modified. Both the S3 bucket policy and the KMS key policy must authorize the delivery.logs.amazonaws.com service principal.

Adım Adım Çözüm

1
Enable sharing with AWS Organizations in AWS RAM.
Allows resource sharing to OUs and member accounts without requiring individual handshake invitations.
Required to cleanly and securely share the VPC subnets from the network account to the Developer OU.
2
Select and purchase Compute Savings Plans.
Applies discount rates automatically to EC2, Fargate, and Lambda across all linked accounts.
Only Compute Savings Plans cover serverless compute resources (Fargate and Lambda) in addition to EC2 instances.
3
Configure the S3 bucket and AWS KMS Customer Managed Key (CMK) in the security logging account.
Ensures the S3 bucket and the CMK key policy explicitly allow delivery.logs.amazonaws.com to write logs and generate data keys.
AWS-managed KMS keys cannot be modified to grant cross-account permissions to the log delivery service, requiring a customer managed key.

Anahtar Kavram

Multi-account resource sharing via AWS RAM, centralized logging with cross-account KMS requirements, and organization-wide compute cost optimization.
Bu soruyu puanla

Konular

Billing, Cost Management, and Resource Sharing Strategy

Bu konudan daha fazla soru