A network account shares an AMI and a subnet via AWS RAM to a workload account that has SCPs denying certain EC2 and networking actions. What must architects understand about that interaction?
Select an answer to reveal the explanation.
Short Explanation
A borrowed library book still has to follow the branch's quiet-hours rules. RAM can hand over an AMI or subnet, but the consumer account's SCPs still gate what you can do with it.
Full Explanation
AWS RAM enables cross-account resource consumption, but SCPs remain a permission boundary for principals in the consumer account. Sharing does not grant org-admin rights or nullify SCPs. Architects must design shares and guardrails together so shared networking or AMIs cannot be used to violate OU policy. Claims that RAM overrides SCPs or CloudTrail are incorrect.