ANS-C01 Question 148
Single answerYou are a network architect for a company that has multiple AWS accounts under a single AWS Organization. Your team needs to share a VPC subnet from one account (Account A) with another account (Account B) to deploy resources like EC2 instances. The solution must ensure minimal administrative overhead and adhere to AWS best practices. Which approach should you use?
- A
Use AWS Resource Access Manager (RAM) to share the VPC subnet with Account B.
- B
Create a peering connection between the VPC in Account A and a new VPC in Account B.
- C
Use cross-account IAM roles to provide access to the VPC resources in Account A.
- D
Migrate all resources to a single AWS account to avoid cross-account access.
Show answer and explanation
Correct answer: A
Explanation
The best way to share a VPC subnet across AWS accounts is by using AWS Resource Access Manager (RAM). RAM allows efficient sharing of AWS resources, including VPC subnets, across accounts within an AWS Organization. It eliminates the need for duplicating infrastructure and provides an easy and secure way to manage shared resources. Peering or IAM roles are not suitable for subnet sharing, and migrating resources to a single account is unnecessary and counterproductive.
- A. Correct.
Correct. AWS Resource Access Manager (RAM) is designed to share resources, such as VPC subnets, across AWS accounts in an organization. This is a scalable and efficient solution with minimal administrative overhead.
- B. Incorrect.
Incorrect. VPC peering allows communication between VPCs but does not enable resource sharing, such as subnets, across accounts. Each account would still need its own subnets, which increases administrative complexity.
- C. Incorrect.
Incorrect. Cross-account IAM roles enable access to AWS resources like S3 buckets or EC2 instances but do not provide a mechanism to share VPC subnets across accounts.
- D. Incorrect.
Incorrect. Migrating all resources to a single account is not necessary and would involve significant effort. AWS provides tools like AWS RAM to securely share resources across accounts without consolidation.