Amazon Exam SAP-C01 Topic 1 Question 17 Discussion

Actual exam question for Amazon's SAP-C01 exam

Question #: 17
Topic #: 1

A company is using AWS Organizations to manage 15 AWS accounts. A solutions architect wants to run advanced analytics on the company's cloud expenditures. The cost data must be gathered and made available from an analytics account. The analytics application runs in a VPC and must receive the raw cost data each night to run the analytics.

The solution architect has decided to use the Cost Explorer API to fetch the raw data and store the data in Amazon S3 in Json format. Access to the raw cost data must be restricted to the analytics application. The solution architect has already created an AWS Lambda function to collect data by the using the Cost Explorer API.

Which additional actions should the solutions architect take to meet these requirements?

ACreate an IAM role in the Organizations master account with permissions to use the Cost Explorer API, and establish trust between the role and the analytics account. Update the Lambda function role and add sts AssumeRole permissions. Assume the role in the master account from the Lambda function code by usinf the AWS security Token Service (AWS STS) AssumeRole API call. Create a gateway-endpoint for Amazon S3 in the analytics VPC. Create an S3 bucket policy that allows access only from S3 endpoint.

BCreate an IAM role in the analytics account with permissions to use the Cost Explorer API. Update the Lambda function and assign the new role. Create a gateway endpoint for Amazon S3 in the analytics VPC. Create an S3 bucket policy that allows access from the analytics VPC by using the aws SourceVPC condition

CCreate an IAM role in the Organizations master account with permissions to use the Cost Explorer API, and establish trust between the role and the analytics account. Update the Lambda function role and add sts AssumeRole permissions. Assume the role in the master account from the Lambda function code by using the AWS security Token Service (AWS STS) AssumeRole API call. Create an interface endpoint for Amazon S3 in the analytics VPC. Create an S3 bucket policy that allows access only from the analytics VPC private CIDR range by using the aws SourceIp condition.

DCreate an IAM role in the analytics account with permissions to use the Cost Explorer API. Update the Lambda function and assign the new role. Create an interface endpoint for Amazon S3 in the analytics VPC. Create an S3 bucket policy that allows only from the S3 endpoint.

Show Suggested Answer

Suggested Answer: C

by Dalene at May 04, 2022, 05:37 PM

Limited Time Offer

25%

Off

Get Premium SAP-C01 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Currently there are no comments in this discussion, be the first to comment!