ANS-C01 Question 226
Single answerAn organization has a multi-account setup managed through AWS Organizations. They want to share a centrally managed Amazon VPC and a Transit Gateway from a networking account with other member accounts for inter-VPC communication across accounts. What is the most efficient way to achieve this while maintaining security and minimizing administrative overhead?
- A
Share the Amazon VPC and Transit Gateway to member accounts using AWS Resource Access Manager (AWS RAM).
- B
Create a peering connection between the Amazon VPC in the networking account and VPCs in each member account.
- C
Use AWS Direct Connect to establish private connectivity between the networking account and each member account.
- D
Deploy individual Transit Gateways in each member account and connect them via peering.
Show answer and explanation
Correct answer: A
Explanation
AWS RAM is designed to share AWS resources, such as Amazon VPCs and Transit Gateways, across accounts in an AWS Organization. By leveraging AWS RAM, the organization can ensure secure, scalable, and centralized resource sharing without needing redundant setups, such as VPC peering or multiple Transit Gateways. This minimizes administrative effort and cost while maintaining security and efficiency.
- A. Correct.
This is the correct answer. AWS RAM allows sharing of resources such as Amazon VPCs and Transit Gateways across accounts within an AWS Organization securely and efficiently, reducing the need for redundant resources and administrative overhead.
- B. Incorrect.
This is not an efficient solution. VPC peering requires manual setup for each connection and does not scale well in a multi-account architecture. It also lacks centralized management.
- C. Incorrect.
AWS Direct Connect is used for creating private connectivity between on-premises environments and AWS, not for sharing resources across AWS accounts.
- D. Incorrect.
Deploying individual Transit Gateways in each account and connecting them via peering increases costs and complexity, and defeats the purpose of centralizing management in the networking account.