A media group with 60 Organizations accounts needs to share inspection VPC subnets and approved Service Catalog portfolios without copying templates or peering each VPC. Which secure sharing mechanism should the cloud team implement to distribute resources across accounts centrally?
Select an answer to reveal the explanation.
Short Explanation
You're lending the family car without handing over the title. Sharing subnets through RAM and portfolios through Service Catalog's Organizations sharing keeps ownership central while accounts use only what you allow.
Full Explanation
The correct approach shares each resource with its native sharing mechanism: AWS RAM shares VPC subnets with Organizations accounts so participants launch resources into the owner's inspection VPC without peering, and Service Catalog shares portfolios by reference through its AWS Organizations integration (trusted access enabled), so no template copies are made and the central admin controls versions. Service Catalog portfolios are not RAM-shareable resources (RAM covers only AppRegistry applications and attribute groups), so a single RAM share cannot do both jobs. The StackSets with Transit Gateway alternative fails on distribution concept because StackSets instantiates separate portfolio copies in every account that must be versioned independently, violating the no-copy requirement, even though Transit Gateway provides valid centralized connectivity. The RAM for subnets plus manual portfolio copying alternative correctly shares networking but reverts to per-account portfolio duplication, breaking centralized approval and version control. The centralized portfolios with per-account inspection VPC alternative fails on resource sharing concept because building local inspection VPCs duplicates network infrastructure, inspection cost, and policy management instead of sharing centrally owned subnets. For exams, remember RAM shares the resource itself while StackSets and copying share deployable code; in practice verify subnet shares in the RAM console and that the portfolio appears in member accounts without importing templates.