A financial corporation manages its AWS environment through AWS Organizations. The organization has a Management account, a dedicated Security and Logging account, a Logistics account, and a Retail account. The corporation has also recently signed a contract with an external consulting firm that operates in a separate, independent AWS account.
The Solutions Architect is tasked with designing a resource sharing, security, and cost management strategy that addresses the following requirements:
1. Compute Cost Optimization: The Retail account runs a containerized microservices platform on AWS Fargate and AWS Lambda. The corporation needs to purchase Savings Plans to cover these workloads.
2. Resource Sharing: The external consulting firm’s AWS account must access a Transit Gateway hosted in the Logistics account to enable secure network connectivity.
3. Cross-Account Logging: The Logistics account must write its CloudTrail logs to a centralized S3 bucket located in the Security and Logging account. The logs must be encrypted at rest, and the Logistics account must be able to read its own logs for local auditing.
4. Billing Demarcation: For chargeback purposes, the Logistics account’s billing reports must show costs calculated at standard AWS public rates, excluding any consolidated volume discounts or organizational Savings Plans benefits.
Which architectural strategy will satisfy all of these requirements?
- Purchase Compute Savings Plans in the Management account. In the Logistics account, enable sharing with external principals in AWS RAM and share the Transit Gateway with the external consulting firm's account. In the Security and Logging account, configure the S3 bucket with a Customer Managed Key (CMK), and update the S3 bucket and KMS key policies to allow cross-account access for the Logistics account. In the Billing Preferences of the Management account, disable Savings Plans sharing for the Logistics account, and use AWS Billing Conductor to create a billing group for the Logistics account with a custom pricing plan that applies standard public rates.Cevap
- BPurchase EC2 Instance Savings Plans in the Management account. In the Logistics account, enable sharing with external principals in AWS RAM and share the Transit Gateway with the external consulting firm's account. In the Security and Logging account, configure the S3 bucket with the AWS-managed KMS key (aws/s3), and update the S3 bucket policy to allow read/write access for the Logistics account. In the Billing Preferences of the Management account, disable Savings Plans sharing for the Logistics account, and use AWS Billing Conductor to create a billing group for the Logistics account with a custom pricing plan that applies standard public rates.
- CPurchase Compute Savings Plans in the Management account. In the Logistics account, create a resource share in AWS RAM for the Transit Gateway targeting the external consulting firm's account ID, without enabling external sharing in AWS RAM. In the Security and Logging account, configure the S3 bucket with a Customer Managed Key (CMK), and update the S3 bucket and KMS key policies to allow cross-account access. Apply a Service Control Policy (SCP) to the Logistics account's organizational unit (OU) that denies access to consolidated billing discounts to generate pro-forma billing reports.
- DPurchase Compute Savings Plans in the Management account. In the Logistics account, create a resource share in AWS RAM for the shared subnet targeting the external consulting firm's account ID, and enable external sharing in AWS RAM. In the Security and Logging account, configure the S3 bucket with the AWS-managed KMS key (aws/s3), and update the S3 bucket policy to allow read/write access. Apply a Service Control Policy (SCP) to the Logistics account's organizational unit (OU) to block volume discount inheritance, and configure billing alerts in AWS Budgets to report pro-forma costs.