Topic 1 Question 465
A company uses an organization in AWS Organizations to manage multiple AWS accounts. The company hosts some applications in a VPC in the company's shared services account.
The company has attached a transit gateway to the VPC in the shared services account.
The company is developing a new capability and has created a development environment that requires access to the applications that are in the shared services account. The company intends to delete and recreate resources frequently in the development account. The company also wants to give a development team the ability to recreate the team's connection to the shared services account as required.
Which solution will meet these requirements?
Create a transit gateway in the development account. Create a transit gateway peering request to the shared services account. Configure the shared services transit gateway to automatically accept peering connections.
Turn on automatic acceptance for the transit gateway in the shared services account. Use AWS Resource Access Manager (AWS RAM) to share the transit gateway resource in the shared services account with the development account. Accept the resource in the development account. Create a transit gateway attachment in the development account.
Turn on automatic acceptance for the transit gateway in the shared services account. Create a VPC endpoint. Use the endpoint policy to grant permissions on the VPC endpoint for the development account. Configure the endpoint service to automatically accept connection requests. Provide the endpoint details to the development team.
Create an Amazon EventBridge rule to invoke an AWS Lambda function that accepts the transit gateway attachment when the development account makes an attachment request. Use AWS Network Manager to share the transit gateway in the shared services account with the development account. Accept the transit gateway in the development account.
ユーザの投票
コメント(7)
- 正解だと思う選択肢: B
B is correct. A is wrong becase TGW peering is done between regions, not accounts. C is rubbish D is overengineered and weird, using Network Manager for sharing the TGW rather than RAM which is best practice.
👍 3Dgix2024/03/20 - 正解だと思う選択肢: B
B Auto accept shared attachments https://docs.aws.amazon.com/vpc/latest/tgw/tgw-transit-gateways.html Then, create create TGW attachment in dev account
👍 3pangchn2024/03/25 - 正解だと思う選択肢: B
A is incorrect: creating and managing another transit gateway in the development account and setting up peering. This adds unnecessary complexity and management overhead.
B is correct: the development account can create transit gateway attachments without needing manual intervention every time an attachment is made.
C is incorrect: Not usecase of VPC endpoints. VPC endpoints are typically used for connecting to AWS services privately without traversing the public internet. This option does not align well with the requirement to access applications in a VPC through a transit gateway.
D is incorrect: too complicated
👍 3trungtd2024/06/12
シャッフルモード