Two counties will federate a shared 911 platform on AWS. Each county's call-data plane must remain isolated even though some platform services are shared. Which multi-account approach best fits?
Select an answer to reveal the explanation.
Short Explanation
Two counties sharing a 911 platform still need separate evidence lockers. Put each county's data plane in its own accounts and OUs, and share only the agreed platform pieces — not the whole keyring.
Full Explanation
Multi-jurisdiction platforms require tenancy isolation so one county cannot access another's sensitive operational data. Separate accounts and OU placement enforce strong blast-radius and policy boundaries while shared services accounts can host common platform components. Co-mingling data planes or granting mutual root access violates isolation and professional multi-tenant municipal design.