AWS Budgets Actions for Cost Control with Least Overhead

SAA-C03 By islever Editorial Last updated

Design cost-optimized storage solutions.

Short answer

B Use AWS Budgets to establish budgets and configure actions to apply a DenyAll policy to the developer's IAM role when thresholds are exceeded.

Question

A company has deployed a multi-account strategy on AWS by using AWS Control Tower. The company has provided individual AWS accounts to each of its developers. The company wants to implement controls to limit AWS resource costs that the developers incur. Which solution will meet these requirements with the LEAST operational overhead?
  1. Instruct each developer to tag all their resources with a tag that has a key of CostCenter and a value of the developer's name. Use the required-tags AWS Config managed rule to check for the tag. Create an AWS Lambda function to terminate resources that do not have the tag. Configure AWS Cost Explorer to send a daily report to each developer to monitor their spending.
  2. Use AWS Budgets to establish budgets for each developer account. Set up budget alerts for actual and forecast values to notify developers when they exceed or expect to exceed their assigned budget. Use AWS Budgets actions to apply a DenyAll policy to the developer's IAM role to prevent additional resources from being launched when the assigned budget is reached. Correct Answer
  3. Use AWS Cost Explorer to monitor and report on costs for each developer account. Configure Cost Explorer to send a daily report to each developer to monitor their spending. Use AWS Cost Anomaly Detection to detect anomalous spending and provide alerts.
  4. Use AWS Service Catalog to allow developers to launch resources within a limited cost range. Create AWS Lambda functions in each AWS account to stop running resources at the end of each work day. Configure the Lambda functions to resume the resources at the start of each work day.

Key Takeaways

The core trap is confusing reactive monitoring tools (Cost Explorer) or manual enforcement (Tags/Lambda) with proactive control mechanisms; AWS Budgets allows attaching IAM policies to halt resource creation upon budget thresholds.

This question evaluates the use of AWS Budgets actions to automatically enforce cost limits in a multi-account environment, specifically focusing on minimizing operational overhead through automated IAM policy application.

Common mistake: Many learners select Option C because it uses AWS Cost Anomaly Detection, which alerts on unusual spending but does not actively prevent or limit the costs, failing the 'limit' requirement.

Expert Analysis

Why the Answer Is Correct

Option B is the correct solution because AWS Budgets supports 'actions' that can trigger specific responses when a budget threshold is reached. By configuring an action to apply a custom IAM policy (such as a DenyAll policy) to the developer's role, the system proactively prevents further resource provisioning without human intervention. This meets the requirement to 'limit costs' with the 'least operational overhead' since it is fully automated once configured.

Why the Other Options Are Wrong

Option A relies on tagging and AWS Config rules, which are reactive and require manual tagging by developers or complex Lambda functions to terminate resources, creating high operational overhead. Option C uses Cost Explorer and Anomaly Detection, which only provide visibility and alerts; they do not restrict or stop spending. Option D involves stopping and starting resources via Lambda, which disrupts workloads unnecessarily and does not prevent new resource creation during the day, making it inefficient and operationally heavy.

Community Comment Notes

Community consensus strongly favors Option B, noting that AWS Budgets has evolved to include powerful control features. As user Scheldon noted, referencing official documentation, Budgets can execute actions like applying IAM policies to prevent running new resources. User NSA_Poker highlighted that while other options might detect or report costs, only Option B actually implements a control to limit them. Some users initially questioned the aggressiveness of a DenyAll policy, but it is recognized as the most effective automated guardrail for strict cost containment.

Official Reference

https://docs.aws.amazon.com/cost-management/latest/userguide/budgets-controls.html

This link opens the official vendor documentation in a new tab.

Exam Strategy

When asked for 'least operational overhead' combined with 'limiting costs', look for native, automated controls rather than scripts, tags, or manual reviews. AWS Budgets actions are designed precisely for this purpose, allowing you to attach IAM policies directly to budgets to enforce hard stops.

Frequently Asked Questions

Can AWS Budgets really stop resources from being launched?

Yes, AWS Budgets supports actions that can trigger IAM policies to deny permissions for launching new resources when a budget threshold is breached.

Why is Cost Anomaly Detection not sufficient for limiting costs?

Cost Anomaly Detection only identifies unusual spending patterns and sends alerts; it does not have the capability to block or restrict further resource creation.

More SAA-C03 FAQ →

Community Votes

B
73%
C
27%

73% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 7 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 7

  1. sandordini 👍 5 Answered B
    My first instinct says B, but Im concerned about the central management abilities of AWS Budgets. It seems that even though it is not planned to be used primarily to control other accounts its still possible: "You can use actions to define an explicit response that you want to take when a budget exceeds its action threshold. You can trigger these alerts on actual or forecasted cost and usage budgets. 1. The management account sets the budget and threshold for the member account using budget filters. 2. When the budget threshold is breached, a budget action applies a restrictive SCP on the OU. So hopefully B :D
  2. Scheldon 👍 5 Answered B
    AnswerB https://docs.aws.amazon.com/cost-management/latest/userguide/budgets-controls.html Taking into consideration that AWS Budgets is allowing to will inform you that you exceeded budged and execute actions like for example IAM actions to prevent running new resources in cloud, I think this option is a good and resonable move. In case of need budged can be always increased and "chains" disabled.
  3. BBR01 👍 4 Answered C
    B and D are too aggressive. A - "Instruct each developer", nope, too much operational work.
  4. NSA_Poker 👍 3 Answered B
    (A) is eliminated. 'send a daily report to each developer' can be ignored. (C) is eliminated. 'detect anomalous spending' won't stop the spending. (D) is eliminated. 'stop running resources at the end of each work day' won't stop developers from mining bitcoin ($$$) the next day. (B) is correct. 'actions to apply a DenyAll policy..' is the only solution that will 'implement controls to limit AWS resource costs that the developers incur.'
  5. f07ed8f 👍 2 Answered C
    Seem AWS Budgets does not have DenyAll function but only Apply a custom Deny IAM policy that restricts the ability for a user, group, or role to provision additional Amazon EC2 resources
Show 2 more comments
  1. MatAlves 👍 2 Answered B
    As beautifully explained in this article: https://docs.aws.amazon.com/cost-management/latest/userguide/budgets-controls.html
  2. LeonSauveterre 👍 1 Answered B
    A - Tags help monitor costs, and AWS Config can enforce tagging rules, but manually tagging is TOO MUCH WORK. B - Preventive (aka not reactive) cost control, good. Too provocative? Yeah, maybe. Developers might experience disruption if they hit their budget limits unexpectedly, and then the cost a little over the budget might not seem like a problem anymore... BUT this is actually a preventive approach with "the LEAST operational overhead". C - "Daily reports" might be too late. D - It can limit resource usage during non-working hours, but overall, you gotta deal with high operational overhead.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

S3 Multi-Region Access Point and Replication Strategy

S-grade

Securing NLB with Security Groups for Minimal Change

S-grade

Most Cost-Effective 7-Year Retention for EBS Snapshots?

S-grade

AWS Forecast vs SageMaker for Time-Series Prediction

S-grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide