ANS-C01 Question 251
Select 2An enterprise uses AWS Organizations to manage multiple accounts and wants to share a central VPC across several accounts to simplify network management. The central VPC should allow resources in other accounts to communicate with each other via private IP addresses. Which combination of AWS services and configurations would BEST achieve this goal?
- A
Use AWS Resource Access Manager (RAM) to share the central VPC subnets with other accounts.
- B
Establish VPC peering connections between the central VPC and each participant account's VPC.
- C
Enable AWS Transit Gateway and attach the central VPC and participant accounts' VPCs to it.
- D
Use AWS Direct Connect to link the central VPC with the participant accounts' VPCs.
- E
Configure Service Control Policies (SCPs) in AWS Organizations to allow cross-account networking.
Show answer and explanation
Correct answers: A, C
Explanation
To expand AWS networking connectivity across multiple accounts, AWS Resource Access Manager (RAM) can be used to share subnets from a central VPC, enabling other accounts to use the shared VPC resources. Alternatively, AWS Transit Gateway can be implemented to act as a central hub for connecting VPCs from different accounts, providing a scalable and efficient solution. VPC peering, AWS Direct Connect, and SCPs do not provide the required functionality for this use case.
- A. Correct.
Correct: AWS Resource Access Manager (RAM) can be used to share subnets from the central VPC across accounts, enabling resources in different accounts to communicate. This is a key feature for cross-account networking.
- B. Incorrect.
Incorrect: VPC peering enables direct communication between two VPCs, but it does not scale well for multiple accounts or allow resources to communicate seamlessly through a central VPC.
- C. Correct.
Correct: AWS Transit Gateway simplifies network architecture by acting as a hub to connect multiple VPCs, including those across accounts. This is a highly scalable solution for multi-account networking.
- D. Incorrect.
Incorrect: AWS Direct Connect is used for establishing a dedicated physical connection between on-premises environments and AWS. It is not suitable for enabling cross-account VPC communication within AWS.
- E. Incorrect.
Incorrect: Service Control Policies (SCPs) are used to manage permissions across accounts in an AWS Organization. They do not handle networking or VPC connectivity.