An enterprise manages a multi-account environment using AWS Organizations. The cloud engineering team is designing a resource sharing, key management, and cost optimization strategy with the following requirements:
- A centralized network account needs to share subnets with other member accounts so they can deploy application workloads in a common VPC.
- A centralized security account needs to share a KMS key with all member accounts to encrypt S3 buckets and EBS volumes.
- The organization wants to purchase Savings Plans from the management account to maximize discounts, but must allow specific member accounts to opt out of sharing their unused Savings Plans.
Which of the following actions should the Solutions Architect take to implement this strategy? (Select TWO.)
- Share the subnets from the network account with the organization using AWS Resource Access Manager (RAM). Member accounts can then launch resources in these subnets and will be billed directly for the EC2 and data transfer costs they generate.Cevap
- Create a Customer Managed Key (CMK) in the security account and configure its key policy to grant usage permissions to the member accounts' IAM principals. Member accounts can then create IAM policies to allow their resources to use the key.Cevap
- CCreate an AWS managed key (aws/s3) in the security account and share it using AWS Resource Access Manager (RAM) with the organization. Use Service Control Policies (SCPs) to allow member accounts to decrypt and encrypt data.
- DPurchase EC2 Instance Savings Plans in the management account to cover Fargate and Lambda costs across the member accounts, and disable discount sharing for specific member accounts in the Billing Preferences of the management account.
- EShare the subnets from the network account via RAM. The network account will pay for all EC2 instances, EBS volumes, and NAT Gateway data transfer costs generated by the member accounts in those subnets.