AWS Certified Solutions Architect Professional · Free Practice Question Medium
Question 22
A finance company needs to implement a solution to share a common network across multiple AWS accounts which are a part of an AWS organization.
The company's operations team uses a dedicated operations account with a VPC, and this must be used for network management. Individual accounts cannot have the ability to manage their own networks. However, individual accounts must be able to create AWS resources within subnets.
Which combination of actions should be taken to meet these requirements? (Select TWO.)
-
A
Create a resource share in AWS Resource Access Manager in the operations account. Select the specific AWS Organizations OU that will use the shared network. Select each prefix list to associate with the resource share.
-
B
Create a resource share in AWS Resource Access Manager in the operations account. Select the specific AWS Organizations OU that will use the shared network. Select each subnet to associate with the resource share.
-
C
Create VPCs in each AWS account within the organization in AWS Organizations. Configure the VPCs to share the same CIDR range and subnets as the VPC in the operations account. Peer the VPCs in each individual account with the VPC in the operations account.
-
D
Create a transit gateway in the operations account and enable transitive routing.
-
E
Enable resource sharing from the AWS Organizations management account.
Reveal correct answers
Correct answers: B, E
Explanation
To share resources within an organization, you must first use the AWS RAM console or AWS Command Line Interface (AWS CLI) to enable sharing with AWS Organizations. When you share resources in your organization, AWS RAM doesn't send invitations to principals. Principals in your organization gain access to shared resources without exchanging invitations.
Sharing at the subnet level will allow the operations account to share specific subnets with other AWS accounts in the organization. By using AWS Resource Access Manager, the operations team can maintain centralized control over network resources while enabling individual accounts to deploy AWS resources within the shared subnets.
CORRECT: "Enable resource sharing from the AWS Organizations management account" is a correct answer (as explained above.)
CORRECT: "Create a resource share in AWS Resource Access Manager in the operations account. Select the specific AWS Organizations OU that will use the shared network. Select each subnet to associate with the resource share" is also a correct answer (as explained above.)
INCORRECT: "Create a transit gateway in the operations account and enable transitive routing" is incorrect.
Transit gateway by default only allows VPCs from the same AWS account to be attached. For our cross-account scenario, we’ll have to use another AWS service called the Resource Access Manager (RAM). RAM lets you share certain resources between AWS accounts. Sharing the transit gateway with another AWS account means that VPCs from that account can be attached to it. Since the question mentions use of AWS organizations, this is not an apt option.
INCORRECT: "Create VPCs in each AWS account within the organization in AWS Organizations. Configure the VPCs to share the same CIDR range and subnets as the VPC in the operations account. Peer the VPCs in each individual account with the VPC in the operations account" is incorrect.
Peering the individual accounts within a VPC can only be used when the accounts are static and small. You can have a maximum of 125 peering connections per VPC. AWS VPC best practices recommend you do not use more than 10 VPCs in a mesh to limit management complexity. To create a mesh network where every VPC is peered to every other VPC, it takes n - 1 connections per VPC where n is the number of VPCs.
INCORRECT: "Create a resource share in AWS Resource Access Manager in the operations account. Select the specific AWS Organizations OU that will use the shared network. Select each prefix list to associate with the resource share" is incorrect.
Prefix lists are used for routing decisions rather than for sharing actual network resources like subnets.
References:
https://docs.aws.amazon.com/ram/latest/userguide/getting-started-sharing.html
Save time with our AWS cheat sheets:
Discussion
Think the marked answer is wrong, or have a better explanation? Share it below — comments appear after review.
