Examkin

Question

Difficulty: MediumBilling, Cost Management, and Resource Sharing Strategy

A company is implementing a multi-account strategy using AWS Organizations. The network infrastructure team has created a central VPC and wants to share specific subnets with various application development teams whose accounts reside in a separate Organizational Unit (OU). The goal is to allow application teams to deploy their EC2 instances into the shared subnets, consolidating network resources. A network engineer attempts to create a resource share in AWS Resource Access Manager (RAM) to share these subnets with the target OU, but the operation fails with an error indicating that sharing is restricted. Which of the following is the most likely cause of this failure and the correct resolution?

  1. A
    The default Service Control Policy (SCP) at the root of the organization blocks all cross-account resource sharing. To resolve this, the administrator must attach an SCP that explicitly grants RAM sharing permissions to the member accounts.
  2. B
    The VPC subnets contain EC2 instances using default AWS-managed KMS keys for EBS volume encryption. To resolve this, the network engineer must migrate all volumes to use Customer Managed Keys (CMKs) and share those keys with the target accounts before sharing the subnets.
  3. Sharing with AWS Organizations has not been enabled in the AWS RAM settings from the organization's management account. To resolve this, the management account administrator must enable sharing within the organization in the AWS RAM console or via the AWS CLI.Answer
  4. D
    VPC subnets cannot be shared within the organization unless the external sharing option is enabled in the AWS RAM settings. To resolve this, the engineer must enable external sharing and specify the individual AWS account IDs of the development teams rather than the OU.

Answer

Sharing with AWS Organizations has not been enabled in the AWS RAM settings from the organization's management account. To resolve this, the management account administrator must enable sharing within the organization in the AWS RAM console or via the AWS CLI.
The correct answer is the option stating that sharing with AWS Organizations has not been enabled in the AWS RAM settings from the management account. In AWS Organizations, sharing resources with accounts or OUs within the organization requires the organization's management account to explicitly enable integration with AWS Organizations in AWS RAM. Once enabled, resources like subnets can be shared, and invitations are automatically accepted by member accounts. If this setting is disabled, attempts to share resources with OUs or accounts inside the organization will fail.

Step-by-Step Solution

1
Identify the sharing scope and target.
The target is an Organizational Unit (OU) within the same AWS Organization.
Understanding the boundary helps determine the required permissions and configuration settings.
2
Check the AWS Resource Access Manager (RAM) organization sharing setting.
By default, sharing within AWS Organizations is disabled in AWS RAM.
Before you can share resources with OUs or accounts in your organization, the management account must enable integration with AWS Organizations.
3
Enable the organization sharing setting in the management account.
The setting is enabled, allowing cross-account sharing within the organization boundary.
This allows resource sharing to succeed and automatically accepts the resource share invitations for member accounts.

Key Concept

Consolidated resource sharing in a multi-account AWS Organization using AWS Resource Access Manager (RAM).
Rate this question

Topics

Billing, Cost Management, and Resource Sharing Strategy

More questions from this topic