A platform team manages 60 member accounts in AWS Organizations and must distribute approved golden VPCs, license-included AMIs, and Service Catalog portfolios from a central shared-services account. Each product must remain centrally versioned, least-privilege accessible, and auditable without copying templates manually. Which cross-account sharing approach securely distributes centrally governed resources?
Select an answer to reveal the explanation.
Short Explanation
You keep one centrally governed set of products and grant member accounts scoped access, without copying templates. Service Catalog and AWS RAM sharing lets you distribute approved portfolios and centrally owned VPC subnets while keeping versions and access under central control.
Full Explanation
Publishing Service Catalog portfolios centrally, sharing them with the organization through Service Catalog, and sharing VPC subnets with AWS RAM is correct because products, constraints, versions, and license-included AMI references remain defined in the shared-services account while member accounts can launch approved products. RAM lets member workloads use subnets in centrally owned golden VPCs rather than creating separate VPCs, supporting least-privilege access, central updates, and CloudTrail auditability without manual template copies. Deploying products with CloudFormation StackSets fails by deployment model: it creates independent stacks in member accounts, which can drift from central versions and does not provide Service Catalog portfolio governance, even with least-privilege roles and centralized logging. Sharing portfolios while using Transit Gateway for VPC networks fails by networking concept: Transit Gateway provides routing and connectivity between VPCs; it does not share the golden VPC subnets themselves. Allowing member accounts to modify product versions fails by governance: local edits undermine centrally versioned control and audit consistency, despite using portfolio and subnet sharing. An exam caveat is that StackSets automates deployment but does not replace Service Catalog versioning and constraint enforcement. As a practical check, verify the portfolio share to the organization, RAM subnet principals, and launch-constraint roles; then confirm version updates remain centrally governed and launches appear in CloudTrail without local template duplication.