Which solution will meet these requirements with the LEAST operational complexity?
In the organization’s management account, use AWS Resource Access Manager (AWS RAM) to share the Cost and Usage Report data with each member account.
In the organization’s management account, configure an S3 event to invoke an AWS Lambda function each time a new file arrives in the S3 bucket that contains the central Cost and Usage Report. Configure the Lambda function to extract each member account’s data and to place the data in Amazon S3 under a separate prefix. Modify the S3 bucket policy to allow each member account to access its own prefix.
In each member account, access AWS Cost Explorer. Create a new report that contains relevant cost information for the account. Save the report in Cost Explorer. Provide instructions that the account administrators can use to access the saved report.
In each member account, create a new S3 bucket to store Cost and Usage Report data. Set up a Cost and Usage Report to deliver the data to the new S3 bucket.
Explanations:
AWS Resource Access Manager (AWS RAM) cannot be used to share Cost and Usage Report data directly between accounts. Each account needs its own reports to view detailed cost data, which cannot be achieved through sharing the data at the resource level.
This solution automates the extraction of each member account’s data and stores it in a way that is accessible only to that account. It minimizes operational complexity by automating data segregation and access management without requiring additional account setups.
While using AWS Cost Explorer provides visibility into costs, it does not fulfill the requirement of viewing detailed cost and utilization data directly from the Cost and Usage Reports. Additionally, this option relies on user action to access reports rather than providing direct access to data.
Creating a new S3 bucket for each member account to store their own Cost and Usage Report data adds operational complexity. Each account would need to be set up individually, which does not align with the requirement for minimal operational complexity. Additionally, managing multiple S3 buckets complicates data management and access control.
I would say the answer is:
In the organization’s management account, configure an S3 event to invoke an AWS Lambda function each time a new file arrives in the S3 bucket that contains the central Cost and Usage Report. Configure the Lambda function to extract each member account’s data and to place the data in Amazon S3 under a separate prefix. Modify the S3 bucket policy to allow each member account to access its own prefix.