A company has deployed a multi-account strategy with AWS Control Tower and provided each developer with an individual AWS account. The company wants controls that limit AWS resource costs incurred by developers with the LEAST operational overhead. Which solution meets these requirements?
Choose an answer
Tap an option to check your answer.
Correct answer: Use AWS Budgets to establish budgets for each developer account. Set up budget alerts for actual and forecast values to notify developers when they exceed or expect to exceed their assigned budget. Use AWS Budgets actions to apply a DenyAll policy to the developer's IAM role to prevent additional resources from being launched when the assigned budget is reached..
Why this is the answer
AWS Budgets directly addresses cost control by allowing you to set spending limits for each developer account. Budget alerts notify developers before they exceed their budget, promoting proactive cost management. AWS Budgets actions can automatically apply a "DenyAll" policy, effectively preventing further resource creation once a budget is hit, which is a highly effective and automated way to enforce cost limits with minimal operational overhead.
The incorrect options have drawbacks:
Tagging and Lambda termination is reactive, can lead to data loss, and requires significant operational overhead to manage and maintain the Lambda functions and Config rules across many accounts.
Cost Explorer and Anomaly Detection are monitoring tools, not enforcement mechanisms. They inform but don't prevent overspending.
Service Catalog limits resource types but doesn't directly cap spending. Stopping/starting resources via Lambda is complex, disruptive, and doesn't prevent new resource creation that exceeds limits.