Examkin

Soru

Zorluk: ZorBilling, Cost Management, and Resource Sharing Strategy

A logistics company is designing its multi-account architecture using AWS Organizations. The architecture includes a billing management account, a centralized infrastructure account, and several development accounts. The company runs workloads on Amazon EC2, AWS Fargate, and AWS Lambda.

The architecture must support the following requirements:
1. Maximize compute cost savings across all accounts using a single commitment-based contract.
2. Share a centralized Transit Gateway in the infrastructure account with the development accounts and an external partner's AWS account that is not part of the organization.
3. Securely share common S3 data buckets in the billing management account with application servers in the development accounts using KMS encryption.

Which TWO actions should a solutions architect recommend to meet these requirements?

  1. Purchase Compute Savings Plans in the billing management account to automatically apply discounts to Amazon EC2, AWS Fargate, and AWS Lambda workloads across all member accounts, and verify that billing discount sharing is enabled in the organization's billing preferences.Cevap
  2. In AWS Resource Access Manager (RAM) in the infrastructure account, create a resource share for the Transit Gateway, enable sharing with external principals, and add the development accounts' Organization Unit (OU) path and the partner's external AWS account ID as principals.Cevap
  3. C
    Purchase EC2 Instance Savings Plans in the billing management account to maximize discounts for the compute infrastructure, covering the EC2 instances, Fargate tasks, and Lambda functions across the organization.
  4. D
    Create a resource share in AWS RAM for the VPC subnets in the centralized infrastructure account, enable sharing with external principals, and add the partner's external AWS account ID to share the network subnets directly.
  5. E
    Encrypt the S3 buckets in the billing management account using the AWS-managed KMS key (aws/s3), and modify the bucket policy to delegate cross-account access to the development accounts' IAM roles.

Cevap

To meet the requirements, the solutions architect must recommend purchasing Compute Savings Plans in the billing management account with discount sharing enabled, and sharing the Transit Gateway via AWS Resource Access Manager by enabling external principals and adding the external partner's AWS account ID along with the internal OUs.
Purchasing Compute Savings Plans in the billing management account with discount sharing enabled successfully covers EC2, Fargate, and Lambda workloads across all member accounts. Sharing the Transit Gateway via AWS Resource Access Manager (RAM) with external sharing enabled allows both internal OUs and external accounts to access the gateway.

Adım Adım Çözüm

1
Analyze the compute cost saving requirements for a hybrid environment containing Amazon EC2, AWS Fargate, and AWS Lambda.
Determine that Compute Savings Plans must be used because EC2 Instance Savings Plans do not cover Fargate or Lambda. The savings plan should be purchased in the management account with discount sharing enabled to apply to all member accounts.
This maximizes savings across the entire organization's diverse compute fleet under a single contract.
2
Determine the sharing constraints for Transit Gateways and VPC subnets via AWS Resource Access Manager (RAM).
Identify that Transit Gateways can be shared externally by enabling external principals in RAM, whereas VPC subnets cannot be shared outside the organization.
This allows sharing the Transit Gateway with both the internal organization's OUs and the external partner's account ID safely, while discarding subnet sharing options.
3
Evaluate the cross-account S3 data sharing and encryption requirements.
Determine that AWS-managed KMS keys (aws/s3) cannot be shared across accounts. A customer managed key with appropriate key policies and bucket policies is required.
This rules out options recommending the use of the default AWS-managed KMS key for cross-account S3 sharing.

Anahtar Kavram

AWS Organizations billing sharing, AWS Resource Access Manager sharing boundaries, and cross-account KMS restrictions.
Bu soruyu puanla

Konular

Billing, Cost Management, and Resource Sharing Strategy

Bu konudan daha fazla soru