Examkin

Soru

Zorluk: OrtaAWS Budgets and Cost Alerts

A research lab runs data processing workloads on Amazon EC2 instances in a single AWS account. The administrator wants to configure AWS Budgets to automatically stop all EC2 instances tagged with `Environment=Sandbox` when the actual monthly spend reaches $550.

Which TWO configurations are required to implement this control? (Select TWO.)

  1. Create an IAM role with a trust policy that allows the AWS Budgets service principal to assume the role, and attach a permissions policy allowing the stopping of EC2 instances.Cevap
  2. Grant the administrator who creates the budget the iam:PassRole permission for the IAM role assigned to the budget action.Cevap
  3. C
    Create an Amazon CloudWatch billing alarm that monitors estimated charges and configure a metric filter to trigger a Systems Manager Automation document.
  4. D
    Configure an AWS Cost Anomaly Detection monitor with a threshold of $550 and link it to an AWS Lambda function that stops the instances.
  5. E
    Attach a Service Control Policy (SCP) to the AWS account that denies ec2:StartInstances and ec2:RunInstances operations.

Cevap

Creating an IAM role that allows the AWS Budgets service principal to assume the role with permissions to stop EC2 instances, and granting the administrator the iam:PassRole permission for that role.
The correct answer consists of creating an IAM role that the AWS Budgets service principal can assume to execute the stop action, and granting the configuring administrator the iam:PassRole permission. Together, these allow AWS Budgets to stop the EC2 instances securely when the budget threshold is exceeded.

Adım Adım Çözüm

1
Configure the IAM role for AWS Budgets.
An IAM role is created with a trust relationship allowing 'budgets.amazonaws.com' to assume it, and it contains policy permissions like 'ec2:StopInstances' and 'ec2:DescribeInstances'.
AWS Budgets must be authorized to perform management actions (like stopping instances) on behalf of the account owner.
2
Configure user permissions for creating the budget action.
The SysOps administrator's IAM policy is updated to include the 'iam:PassRole' permission targeting the AWS Budgets IAM role.
To prevent privilege escalation, AWS requires users to have explicit 'iam:PassRole' permissions when assigning roles to services.
3
Configure the AWS Budgets action inside the AWS Billing console.
A cost budget is set up with an actual threshold of $550, linking the action type to stop the EC2 instances using the configured IAM role.
This links the budget violation to the automated containment action.

Anahtar Kavram

AWS Budgets Actions allow SysOps administrators to configure automated remediation controls (such as stopping EC2 or RDS instances) when budget thresholds are breached, requiring a service-trusted IAM role and iam:PassRole permissions.
Bu soruyu puanla

Konular

AWS Budgets and Cost Alerts

Bu konudan daha fazla soru