ANS-C01 Question 167
Select 3Your organization is using AWS Organizations and has multiple accounts under a consolidated billing setup. The networking team has created a highly available and secure VPC with necessary subnets, route tables, and security groups in the Networking account. The team now wants to allow the Application account to deploy resources into this existing VPC without the need to duplicate VPC setup or manage inter-VPC connectivity. Which of the following are capabilities or advantages of using VPC sharing in this scenario?
- A
The Application account can create and manage its own subnets in the shared VPC.
- B
The Networking account retains full control over the VPC's route tables, security groups, and network ACLs.
- C
Resources launched in the shared VPC by the Application account will automatically use the Networking account's allocated IP address ranges.
- D
The Application account can share resources in the VPC with a third account without involving the Networking account.
- E
The Application account will incur charges for the resources it launches in the shared VPC.
Show answer and explanation
Correct answers: B, C, E
Explanation
VPC sharing allows multiple AWS accounts to deploy resources into a centrally managed VPC owned by a single account (the owner). The owning account retains control over key network configurations like route tables and security groups, while participant accounts can launch resources into shared subnets. This eliminates the need for inter-VPC peering or duplicating VPC setups, enabling efficient resource management and cost allocation across accounts.
- A. Incorrect.
Incorrect: Only the owning account (in this case, the Networking account) can create and manage subnets in a shared VPC. Participant accounts, like the Application account, can only launch resources into subnets shared with them.
- B. Correct.
Correct: The Networking account, as the owner of the shared VPC, retains control over route tables, security groups, and network ACLs to ensure centralized management.
- C. Correct.
Correct: Resources launched in the shared VPC by participant accounts like the Application account will use the IP address ranges of the shared VPC, which are defined by the Networking account.
- D. Incorrect.
Incorrect: Participant accounts cannot share the shared VPC or its resources with other accounts. Only the owning account (Networking account) can manage sharing settings.
- E. Correct.
Correct: Each participant account incurs charges for the resources they launch in the shared VPC. This ensures cost allocation is accurate across accounts.