A network account owns a Transit Gateway and a Route 53 Resolver rule set that parks, courts, and public-works accounts must use without recreating those resources. How should those networking assets be shared?
Select an answer to reveal the explanation.
Short Explanation
Picture one city highway interchange and one DNS rulebook owned by Public Works Networking — departments get an on-ramp, not their own cloverleaf. AWS RAM is how you share that Transit Gateway and Resolver rule set into workload accounts cleanly.
Full Explanation
Networking assets such as a Transit Gateway and a Route 53 Resolver rule set owned by a network account should be shared to parks, courts, and public-works accounts with AWS Resource Access Manager. RAM lets workload accounts attach to the shared Transit Gateway and associate Resolver rules without recreating those resources or building a mesh of duplicates. Central ownership plus shared consumption is the multi-account networking pattern municipalities use for consistent hybrid DNS and hub connectivity across departments.
Duplicating a Transit Gateway in every workload account and peering them mesh-style recreates the sprawl and routing complexity RAM exists to avoid. Exporting Resolver rules as CSV files and pasting them manually into each account weekly guarantees drift and outages when a domain changes. Putting the Transit Gateway in a public subnet of one sandbox account and peering everyone to that sandbox misplaces a foundational network resource into a non-authoritative, weakly governed account.
Exam caveat: RAM shares Transit Gateway, Route 53 Resolver rules, subnets, and related networking resources across accounts and OUs within an Organization—prefer sharing over duplication on SAP-C02. Operational check: share the Transit Gateway and Resolver rules via RAM to the workload OU, accept the shares, attach a pilot VPC, resolve a test private name through the shared rules, and confirm sandbox accounts are excluded from production shares.