A company is designing a multi-account architecture using AWS Organizations. The network team needs to share a set of private subnets from a central Network VPC in a dedicated Network account with application teams operating in different member accounts within specific Organizational Units (OUs). The security team requires that all VPC Flow Logs from the shared subnets be consolidated into a central Amazon S3 bucket in a Security account, encrypted using a Customer Managed Key (CMK) in AWS Key Management Service (AWS KMS). Additionally, the finance team wants to ensure that Compute Savings Plans purchased in the Management account are applied to all member accounts, except for a specific OU containing sandbox accounts used for third-party contractor testing, which must pay standard On-Demand rates for chargeback reporting. Which strategy should a Solutions Architect recommend to meet these requirements with the least administrative overhead?
- Enable resource sharing with AWS Organizations in the AWS Resource Access Manager (RAM) console. Create a resource share in the Network account for the subnets and share it with the application OUs. In the Security account, create an S3 bucket and a KMS Customer Managed Key (CMK) with a key policy allowing the VPC Flow Logs service principal (delivery.logs.amazonaws.com) to generate data keys and decrypt. Configure the S3 bucket policy to allow log delivery. In the Network account, configure VPC Flow Logs to publish to the S3 bucket. In AWS Billing Conductor, create a billing group containing only the sandbox accounts, ensuring the Management account is excluded from this group.Cevap
- BEnable resource sharing with AWS Organizations in the AWS RAM console. Create a resource share in the Network account for the subnets and share it with the application OUs. In the Security account, create an S3 bucket encrypted with the default AWS-managed KMS key (aws/s3) and configure the bucket policy to allow log delivery from the Network account. In the Network account, configure VPC Flow Logs to publish to the S3 bucket. In the Billing Preferences of the Management account, disable Savings Plans sharing for the sandbox OU by applying an IAM policy.
- CEnable resource sharing with AWS Organizations in the AWS RAM console. Create a resource share in the Network account for the subnets and share it with the application OUs. In the Security account, create an S3 bucket and a KMS CMK with a key policy allowing the VPC Flow Logs service principal. Configure the S3 bucket policy and enable VPC Flow Logs. In the Billing Preferences of the Management account, disable Savings Plans sharing globally. Use Amazon Athena queries on the Cost and Usage Report (CUR) to manually calculate and apply the Savings Plans discounts to all non-sandbox member accounts.
- DIn the Network account, create an AWS RAM resource share for the subnets. Create a Service Control Policy (SCP) in the Management account and attach it to the application OUs to grant permissions for the shared subnets. In the Security account, create an S3 bucket and a KMS CMK. Configure VPC Flow Logs to write to the S3 bucket. Create an AWS Glue ETL job to process the consolidated Cost and Usage Report (CUR) hourly, filtering out the sandbox accounts and manually recalculating the Savings Plans discounts for all other accounts.
Cevap
Enable resource sharing with AWS Organizations in the AWS Resource Access Manager (RAM) console. Create a resource share in the Network account for the subnets and share it with the application OUs. In the Security account, create an S3 bucket and a KMS Customer Managed Key (CMK) with a key policy allowing the VPC Flow Logs service principal (delivery.logs.amazonaws.com) to generate data keys and decrypt. Configure the S3 bucket policy to allow log delivery. In the Network account, configure VPC Flow Logs to publish to the S3 bucket. In AWS Billing Conductor, create a billing group containing only the sandbox accounts, ensuring the Management account is excluded from this group.
The correct strategy leverages AWS RAM to share the subnets within the AWS Organization, uses a Customer Managed Key (CMK) with policy modifications to allow the VPC Flow Logs service principal to write encrypted logs across accounts, and utilizes AWS Billing Conductor to isolate the sandbox accounts in their own billing group. Since the sandbox accounts are separated from the Management account that purchased the Compute Savings Plans, the pro-forma invoices generated by AWS Billing Conductor will model the sandbox accounts' usage at standard On-Demand rates, automating chargebacks with minimal administrative overhead.
Adım Adım Çözüm
Anahtar Kavram
AWS Billing Conductor allows organizations to define custom billing groups for pro-forma billing, enabling selective exclusion of global Savings Plans and Reserved Instances discounts for specific accounts. Meanwhile, AWS RAM enables secure cross-account subnet sharing within AWS Organizations, and Customer Managed Keys (CMKs) are required for cross-account service principal encryption tasks (such as VPC Flow Logs delivery).
Tahmini Süre:2m 30s