A media group with separate network and workload accounts must share a central VPC subnet, Route 53 zones, and transit connectivity without duplicating infrastructure. Which cross-account resource sharing design enables secure centralized networking?
Select an answer to reveal the explanation.
Short Explanation
You can treat the network account like a shared conference center rather than building one for every team. AWS RAM and a centralized Transit Gateway provide sharing without the complexity of mesh peering.
Full Explanation
AWS Resource Access Manager (RAM) lets the network account share subnets and Route 53 Resolver rules with workload accounts, while their VPCs attach to a centralized Transit Gateway. This gives applications access to shared network and DNS resources without duplicating VPC infrastructure, while preserving centralized control and auditability. Keeping separate private hosted zones in each account fails to centralize DNS: it requires duplicated zone management and forwarding logic instead of sharing DNS resources. Connecting VPCs with full-mesh peering fails as a scalable transit design because peering is non-transitive and does not provide the hub routing, centralized policy, or extensible hybrid connectivity of a Transit Gateway. Using PrivateLink endpoints with a central Transit Gateway fails the subnet-sharing requirement: PrivateLink provides secure access to particular services, not access to the underlying shared VPC subnet. An exam caveat is to distinguish sharing network constructs through RAM from sharing service access through PrivateLink, and Transit Gateway’s transitive routing from non-transitive peering. As a practical check, verify RAM resource shares, resolver rule associations, and Transit Gateway attachments and route tables in the network account when troubleshooting workload connectivity.