ANS-C01 Question 252
Select 2Your organization operates multiple AWS accounts managed using AWS Organizations. To centralize and share networking resources such as VPC subnets and transit gateways across these accounts, which methods would you use to enable secure and scalable connectivity?
- A
Use AWS Resource Access Manager (RAM) to share resources like subnets and transit gateways across accounts in your organization.
- B
Use VPC peering to establish connectivity between VPCs in different accounts within the organization.
- C
Enable AWS Direct Connect to create a private connection between the accounts and share resources.
- D
Use AWS Transit Gateway to interconnect VPCs across multiple accounts and regions and share it via AWS RAM.
- E
Create an IAM role in each account and use it to manually manage network configurations and resource sharing.
Show answer and explanation
Correct answers: A, D
Explanation
To expand networking connectivity across AWS accounts in an organization, AWS offers scalable and secure solutions like AWS RAM and AWS Transit Gateway. AWS RAM allows resource sharing, such as transit gateways and subnets, across accounts, while AWS Transit Gateway simplifies interconnecting multiple VPCs across regions and accounts. These methods align with AWS best practices for multi-account networking and centralized management.
- A. Correct.
Correct. AWS Resource Access Manager (RAM) is specifically designed to share AWS resources, such as subnets and transit gateways, across accounts in an organization securely and efficiently.
- B. Incorrect.
Incorrect. VPC Peering allows direct connectivity between two VPCs but does not scale well for multiple accounts, nor does it integrate with AWS Organizations or RAM for efficient resource sharing.
- C. Incorrect.
Incorrect. AWS Direct Connect is a physical connection service to connect on-premises infrastructure to AWS, not a method for sharing resources across AWS accounts.
- D. Correct.
Correct. AWS Transit Gateway enables centralized connectivity for multiple VPCs and accounts. It can be shared across accounts in an AWS Organization using AWS RAM.
- E. Incorrect.
Incorrect. Manually creating IAM roles to manage resource sharing between accounts is error-prone, does not scale, and is not a recommended AWS best practice.