SCS-C03 practice question: Sharing resources securely (AWS RAM, Service Catalog)
Security Foundations and Governance A free question from our original SCS-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.
A logistics firm runs a shared services VPC with private subnets for its databases and analytics clusters. Application teams in 25 accounts across the organization need to launch resources in those subnets. The network team does not want the subnets shared with any account outside the organization.
The network team wants to keep one VPC for all teams, avoid managing many peering connections, and have the sharing follow the organization structure as new accounts are added.
Which solution meets these requirements with the LEAST operational overhead?
Choose one answer.
AA. Share the private subnets with AWS Resource Access Manager using the account IDs of the 25 application accounts as principals. Accept any share request that the network team approves later from accounts that join the project.
BB. Create VPC peering connections from the shared services VPC to each of the 25 application VPCs, and update the route tables on both sides. Restrict each peering route to the subnets that each team needs.
CC. Share the private subnets through AWS Resource Access Manager with the organization or the OU of the application accounts, with sharing outside the organization turned off.
DD. Create a Transit Gateway in the network account, share it through RAM, and allow external principals so that outside teams can attach too. Attach each team VPC to the gateway.
Show the answer and explanation
Answer: C
A. Wrong: Sharing by account ID means every new account needs a new share, which defeats the goal of following the organization. Accepting requests from accounts outside the organization also risks sharing with accounts the team does not control.
B. Wrong: Peering works, but 25 connections and their routes are hard to manage, and each new account adds more. Peering does not follow the organization structure, which the network team wants.
C. Right: Correct. Sharing to the organization or an OU follows the account structure, and RAM can restrict sharing to principals inside the organization. Teams launch into the shared subnets without a new connection per account. Learn more: What is AWS Resource Access Manager? (opens in a new tab)
D. Wrong: Allowing external principals opens the network to accounts outside the organization, which the network team forbids. A Transit Gateway also adds attachments and routes for each VPC that the team must manage.
Explanation
AWS RAM can share subnets with an organization or an OU, and it can block sharing with accounts outside the organization. Accounts added to that OU get access automatically, so the network team keeps one VPC with no per-account connections. Per-account shares, peering, and an external-friendly transit gateway each miss one requirement.
Want more on Sharing resources securely (AWS RAM, Service Catalog)? The 5 full-length practice sets have 5 more Sharing resources securely (AWS RAM, Service Catalog) questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →