A solutions architect is designing a resource sharing strategy for a multi-account environment. The architect needs to share a custom VPC subnet from a central network account to a partner company's AWS account, which is not part of the architect's AWS Organization. The architect attempts to use AWS Resource Access Manager (RAM) to share the subnet, but the process fails. Which configuration change is required to successfully share this subnet?
- AAttach a Service Control Policy (SCP) to the root of the AWS Organization that explicitly grants resource sharing permissions to the partner's AWS account ID.
- BCreate the resource share directly using the partner's AWS account ID without modifying RAM settings, as RAM automatically permits sharing with any valid AWS account ID by default.
- Enable sharing with principals outside your organization in the AWS Resource Access Manager settings, and then create the resource share specifying the partner's AWS account ID.Answer
- DModify the resource-based policy of the AWS-managed KMS key associated with the subnet to grant the partner's account access before creating the resource share in RAM.
Answer
Enable sharing with principals outside your organization in the AWS Resource Access Manager settings, and then create the resource share specifying the partner's AWS account ID.
The correct answer is to enable sharing with principals outside the organization in the AWS Resource Access Manager settings, and then share the subnet by specifying the partner's account ID. By default, AWS RAM only permits sharing within the same AWS Organization to prevent data leakage. Enabling this setting allows the principal to share supported resources with external accounts.
Step-by-Step Solution
Key Concept
AWS Resource Access Manager (RAM) allows sharing AWS resources across accounts, but sharing outside the AWS Organization requires enabling external sharing in RAM settings.