Examkin

Question

Difficulty: MediumAWS VPN, Direct Connect, and Transit Gateway Management

A company is using AWS Organizations to manage multiple AWS accounts. A SysOps Administrator in the primary network management account creates an AWS Transit Gateway and shares it with a member account using AWS Resource Access Manager (RAM). A SysOps Administrator in the member account accepts the resource share and creates a Transit Gateway VPC attachment. However, traffic is not routing between the member VPC and other VPCs connected to the Transit Gateway. In the member account, the Transit Gateway attachment state is displayed as 'pendingAcceptance'. Which action is required to resolve this issue and enable network transit?

  1. A
    The SysOps Administrator in the member account must update the subnet route tables to target the Transit Gateway attachment.
  2. B
    The SysOps Administrator in the member account must configure the AWS Resource Access Manager (RAM) resource share to enable automatic attachment acceptance.
  3. The SysOps Administrator in the primary network management account must accept the shared attachment request.Answer
  4. D
    The SysOps Administrator in the member account must add an inbound rule to the stateless Network ACL of the attachment subnets to allow ephemeral port range traffic.

Answer

The SysOps Administrator in the primary network management account must accept the shared attachment request.
The correct action is for the administrator in the primary network management account to accept the shared attachment request. When a Transit Gateway is shared with another AWS account via AWS Resource Access Manager (RAM), any VPC attachments created by the recipient account are placed in a 'pendingAcceptance' state. The owner of the Transit Gateway must explicitly accept the attachment request before the VPC can route traffic through the gateway, unless auto-acceptance of shared attachments has been pre-configured on the Transit Gateway.

Step-by-Step Solution

1
Identify the state of the Transit Gateway VPC attachment in the member account.
The attachment state is 'pendingAcceptance'.
This state indicates that the Transit Gateway owner must approve the shared resource attachment before traffic can flow.
2
Log in to the primary network management account (the owner of the Transit Gateway) and navigate to the AWS Transit Gateway console.
Locate the shared VPC attachment under 'Transit Gateway Attachments'.
Only the owning account has the authorization to accept attachments created by external or shared accounts.
3
Select the pending attachment and click 'Actions' -> 'Accept'.
The attachment state transitions to 'pending' and eventually to 'available'.
Accepting the attachment enables routing between the member account's VPC and the Transit Gateway.

Key Concept

Acceptance workflow for shared Transit Gateway attachments across AWS accounts
Rate this question

Topics

AWS VPN, Direct Connect, and Transit Gateway Management

More questions from this topic