A company manages its multi-account environment using AWS Organizations with consolidated billing. The infrastructure team has created a shared VPC in a central Network account and wants to share its subnets with a newly acquired subsidiary account. The finance team requires that the subsidiary's usage be calculated with a 10% markup for internal chargeback reporting, while the actual AWS invoice paid by the management account remains unchanged. The subsidiary account is not yet a member of the AWS Organization. Which of the following strategies should a solutions architect implement to meet these requirements?
- Invite the subsidiary account to join the AWS Organization. Enable resource sharing within the organization in AWS Resource Access Manager (RAM), create a resource share for the subnets in the Network account, and associate the subsidiary account as a principal. In AWS Billing Conductor, create a billing group containing the subsidiary account, create a custom pricing plan with a pricing rule that applies a 10% markup, and associate the plan with the billing group.Cevap
- BKeep the subsidiary account outside the AWS Organization. In AWS RAM, create a resource share for the subnets, set the principal sharing option to allow external accounts, and have the subsidiary account accept the invitation. In AWS Billing Conductor, create a billing group, add the external subsidiary account, and configure a custom pricing plan with a pricing rule that applies a 10% markup.
- CInvite the subsidiary account to join the AWS Organization. In AWS RAM, create a resource share for the subnets in the Network account. Attach a Service Control Policy (SCP) to the subsidiary's Organizational Unit (OU) that allows ram:AcceptResourceShareInvitation to automatically accept the resource share. In AWS Billing Conductor, create a billing group for the subsidiary account and configure a custom line item to apply a 10% markup on all consolidated billing reports.
- DInvite the subsidiary account to join the AWS Organization. In AWS RAM, create a resource share for the subnets. If the shared subnets contain resources encrypted using the AWS-managed KMS key for Amazon Elastic Block Store (EBS), modify the key policy of the AWS-managed KMS key to grant the subsidiary account permissions. In AWS Billing Conductor, create a billing group for the subsidiary account and configure a custom pricing plan with a 10% markup.
Cevap
Invite the subsidiary account to join the AWS Organization, enable organization resource sharing in AWS RAM to share the subnets, and use AWS Billing Conductor to configure a billing group with a custom pricing plan and a 10% markup pricing rule.
The correct strategy requires first inviting the subsidiary account to the AWS Organization because AWS Billing Conductor can only manage billing groups for accounts within the same consolidated billing family. Once the account is in the organization, AWS Resource Access Manager (RAM) can share the subnets directly with the account ID (or its OU) without requiring invitation acceptance, provided organization sharing is enabled. Finally, AWS Billing Conductor is used to group the subsidiary account and apply a custom pricing plan with a pricing rule containing a 10% markup, which satisfies the custom chargeback reporting requirement while leaving the management account's actual AWS invoice unchanged.
Adım Adım Çözüm
Anahtar Kavram
AWS Billing Conductor manages custom billing rules for accounts within an AWS Organization, while AWS RAM enables cross-account resource sharing with differences in validation between internal and external accounts.