SAP-C03 practice question: Cross-account resource sharing (AWS RAM)
Security, Compliance, and Governance A free question from our original SAP-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.
A logistics firm's network team runs the company's shared subnets in a network account. About 15 application accounts must launch databases and containers into those subnets, but the network team must keep ownership of the subnets, their route tables and their IP ranges.
The network team wants new application accounts added to the shared subnets without a manual change in the network account for each one.
Which solution meets these requirements?
Choose one answer.
AA. Peer each application VPC with the network account's VPC, and let each application team create its own subnets in the peered VPC.
BB. Deploy the network stack into each of the 15 accounts with CloudFormation StackSets, so that each account gets its own copy of the subnets and route tables.
CC. Share the subnets from the network account with AWS Resource Access Manager, using the organization as the principal, so each application account can launch resources into them.
DD. Create an IAM role in the network account for each application team, and let the teams assume the role to change the shared route tables and the IP ranges.
Show the answer and explanation
Answer: C
A. Wrong: Peering connects the networks but leaves the subnets in the application accounts, so the network team does not own the subnets. The design also needs a peering connection and routes for every account.
B. Wrong: Each account would own its own copy of the subnets and routes, so the network team would lose central control of the IP ranges. Copies also drift as the network changes.
C. Right: Correct. RAM shares the subnets while the network account keeps ownership of them, their route tables and their CIDR ranges. Accounts that join the organization get access without a manual change in the network account.
D. Wrong: This gives the application teams the power to change the routes and ranges that the network team should own. Assuming a role does not put the subnets into the application accounts' scope.
Explanation
RAM shares the subnets from the network account to the organization, so ownership of the subnets and routes stays central while accounts launch into them. Peering, copied stacks and roles that change routing each break the ownership or scale requirement.
Want more on Cross-account resource sharing (AWS RAM)? The 5 full-length practice sets have 5 more Cross-account resource sharing (AWS RAM) questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →