SAP-C02 Question 115
Single answerYour organization has multiple AWS accounts for development, staging, and production environments. To simplify resource management and reduce duplication, you want to share a central Amazon RDS database instance across the staging and production accounts. Which approach should you use to enable secure and seamless resource sharing?
- A
Create a VPC peering connection between the staging and production accounts and access the RDS instance using its private endpoint.
- B
Use AWS Resource Access Manager (RAM) to share the RDS instance with the staging and production accounts.
- C
Configure cross-account IAM roles to allow staging and production accounts to access the RDS instance directly.
- D
Enable AWS Transit Gateway and route traffic between the staging and production accounts to access the RDS instance.
Show answer and explanation
Correct answer: B
Explanation
AWS Resource Access Manager (RAM) is the native AWS service intended for securely sharing resources like Amazon RDS across AWS accounts. It allows you to share resources without needing to duplicate them or rely on complex configurations. Other approaches like VPC peering, IAM roles, or Transit Gateway are better suited for networking or identity management but are not purpose-built for resource sharing.
- A. Incorrect.
VPC peering allows network connectivity between VPCs, but it does not provide resource sharing for services like Amazon RDS. Additional configurations would be required to manage access and security.
- B. Correct.
AWS Resource Access Manager (RAM) is specifically designed for sharing AWS resources, such as Amazon RDS, across accounts in a secure and managed way. This is the recommended approach.
- C. Incorrect.
Cross-account IAM roles enable identity-based access control, but they do not facilitate the sharing of RDS resources. This would require additional custom implementations that are not as secure or straightforward as using AWS RAM.
- D. Incorrect.
AWS Transit Gateway is used for managing network traffic between multiple VPCs or on-premises networks but does not natively support resource sharing. It is not the best fit for this use case.