ANS-C01 Question 223
Single answerAn organization is using AWS Organizations with multiple AWS accounts. The organization needs to set up a shared network architecture using an AWS Transit Gateway to connect VPCs across multiple accounts while ensuring centralized management. How should the organization configure this setup to meet the requirements?
- A
Share the Transit Gateway across accounts using AWS Resource Access Manager (AWS RAM) and attach VPCs from each account to the shared Transit Gateway.
- B
Create separate Transit Gateways in each account and use VPC peering to connect them.
- C
Enable Cross-Region VPC sharing and attach all VPCs directly to a single account's Transit Gateway.
- D
Use Direct Connect to connect all VPCs across accounts to the Transit Gateway.
Show answer and explanation
Correct answer: A
Explanation
The best way to share a Transit Gateway across multiple accounts in an AWS Organization is to use AWS Resource Access Manager (AWS RAM). AWS RAM allows you to share the Transit Gateway with other accounts within the organization, enabling centralized management and efficient connectivity for VPCs across accounts. This eliminates the need for creating multiple Transit Gateways or using less efficient methods like VPC peering.
- A. Correct.
This is correct. AWS Transit Gateway can be shared across multiple accounts in the same organization using AWS RAM, allowing VPCs from different accounts to connect to the shared Transit Gateway for centralized management.
- B. Incorrect.
This is incorrect. Creating separate Transit Gateways in each account and connecting them via VPC peering is not efficient or scalable, especially when AWS RAM allows resource sharing across accounts.
- C. Incorrect.
This is incorrect. Cross-Region VPC sharing is not a feature, and attaching VPCs directly from multiple accounts to a single account's Transit Gateway would require manual permissions and is not the intended scalable solution.
- D. Incorrect.
This is incorrect. Direct Connect is used to establish dedicated network connections between on-premises environments and AWS, not for connecting VPCs across accounts to a Transit Gateway.