SOA-C03 practice question: StackSets and resource sharing (2 of 2)
Deployment, Provisioning, and Automation A free question from our original SOA-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.
A solar installer runs a central networking account that owns a VPC with private subnets, NAT gateways and a Direct Connect connection.
Application teams in other accounts in the same AWS Organization must launch their EC2 instances directly into those central subnets, while the networking team keeps sole control of routing.
Which approach should a CloudOps engineer use?
Choose one answer.
AA. Create a VPC peering connection from each application account's VPC to the central VPC.
BB. Deploy a copy of the VPC to every application account with a CloudFormation StackSet.
CC. Create IAM roles in the networking account that the application teams assume to launch instances there.
DD. Share the central subnets with the application accounts by using AWS Resource Access Manager.
Show the answer and explanation
Answer: D
A. Wrong: Peering connects separate VPCs, so instances would still launch into each team's own VPC. It also does not route traffic to the central NAT gateways or Direct Connect connection. Learn more: What is VPC peering? (opens in a new tab)
C. Wrong: This would put the application teams' instances in the networking account, mixing ownership and billing. It also gives them access to the networking account itself. Learn more: IAM roles (opens in a new tab)
VPC sharing uses AWS RAM to share subnets with other accounts in an organization. Participants launch their own resources into the shared subnets, while the owner manages the VPC, routes and gateways. Peering and per-account VPCs keep networks separate.
Want more on StackSets and resource sharing? The 5 full-length practice sets have 10 more StackSets and resource sharing questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →