ANS-C01 Question 259
Single answerYour company is managing a large-scale, multi-account AWS environment. To ensure consistent network configurations across accounts, you need to automate the creation and management of Virtual Private Clouds (VPCs), subnets, and route tables in each account. Additionally, the solution must minimize manual intervention and support version control for infrastructure changes. Which approach should you take?
- A
Use AWS CloudFormation templates to define the network infrastructure and deploy them across accounts using AWS CloudFormation StackSets.
- B
Manually create the VPCs, subnets, and route tables in each account using the AWS Management Console.
- C
Write custom scripts using the AWS CLI to configure the network infrastructure and run the scripts in each account periodically.
- D
Use AWS Control Tower to provision and manage the network infrastructure automatically across accounts.
Show answer and explanation
Correct answer: A
Explanation
The best approach for automating network infrastructure in a multi-account setup is to use AWS CloudFormation templates combined with AWS CloudFormation StackSets. This method allows you to define infrastructure as code, ensuring consistency, automation, and version control across all accounts. While other options provide partial solutions, they either involve significant manual effort, lack scalability, or do not align with the specific requirements of provisioning and managing network resources.
- A. Correct.
This is the correct answer. AWS CloudFormation allows you to define your network infrastructure as code, enabling automation, version control, and repeatability. AWS CloudFormation StackSets extend this capability to deploy the infrastructure across multiple AWS accounts and regions.
- B. Incorrect.
This option requires significant manual effort and does not scale well in a large multi-account environment. It also lacks version control and automation, making it unsuitable for the given requirements.
- C. Incorrect.
While using AWS CLI scripts can automate the process to some extent, it does not provide the version control, robust automation, and scalability of AWS CloudFormation. Managing and maintaining custom scripts across multiple accounts can also become complex.
- D. Incorrect.
AWS Control Tower is primarily used for setting up and governing multi-account AWS environments. However, it does not offer direct functionality for provisioning and managing specific network configurations such as VPCs, subnets, and route tables.