A parcel carrier's application account must launch instances into a subnet that stays owned by the network account. Both accounts are in the same organization. What should they configure?
Select an answer to reveal the explanation.
Short Explanation
Peering is a bridge between two houses, not a key to a room that stays in the first house. You want the application account to launch into the network account's subnet, and RAM shares that subnet without moving it. A copied CIDR is a second network, and it overlaps instead of sharing.
Full Explanation
AWS RAM can share a subnet with another account in the same organization. The subnet, its route table, and its network ACL stay with the network account, and the application account launches instances and other supported resources into that shared subnet. VPC peering forwards traffic between two VPCs, and it does not place the application account's elastic network interfaces into the network account's subnet. A new subnet that reuses the same CIDR is a different network, and overlapping ranges cannot be routed together as one subnet. A transit gateway attachment connects VPCs for routing and does not copy the subnet's addresses into the other account. Caveat: the application account cannot edit the shared subnet's route table or network ACL, because the network account still owns those controls. Operational check: from the application account, launch a test instance into the shared subnet and confirm the network interface lands there while the subnet owner is still the network account.