How to Set Up a Centrally Managed Dual-Stack VPC Shared via AWS RAM?

Quick Answer

The correct combination is BCE: create a VPC with an Amazon-provided IPv6 CIDR (B), share the subnets with the workload account using AWS RAM (C), and provide dual-stack internet connectivity with an internet gateway, egress-only internet gateway, and NAT gateways (E).

Breaking Down the Requirements

The scenario describes a centralized networking account inside AWS Organizations. The network operations team wants to manage the network centrally, while other teams need the ability to deploy their own infrastructure in the same environment. The environment must support both IPv4 and IPv6 and have internet connectivity in a dual-stack configuration.

This implies that:

• The VPC must support both IPv4 and IPv6.
• Subnets must be shared with workload accounts, not the entire VPC.
• The internet path must handle IPv4 and IPv6 separately or together, using the appropriate AWS gateway constructs.

Why Option B Is Correct

Option B correctly uses an Amazon-provided IPv6 CIDR block. In AWS, when you create a VPC, you associate an IPv4 CIDR and can associate an IPv6 CIDR from Amazon's pool. The IPv6 block is globally unique, routable, and designed for direct use. Option A specifies 2001:db8:c5a:6000::/56, which is part of the documentation address block defined in RFC 3849. That prefix is not usable on the internet and cannot be allocated to your VPC. Even if you used a legitimate IPv6 CIDR, you would need to bring your own IP (BYOIP) rather than simply entering it into the VPC creation wizard. Therefore, B is the appropriate choice.

Why Option C Is Correct

Option C uses AWS Resource Access Manager (AWS RAM) to share subnets, not the VPC. VPC sharing is a well-established AWS pattern that lets you share one centrally managed VPC with multiple accounts. The networking account owns the VPC and subnets, and the workload accounts can launch resources into those shared subnets while still respecting centrally managed network controls. AWS RAM supports sharing subnets as a resource type. The workload account must accept the resource share, which is exactly what option C describes.

Option D is wrong because AWS RAM does not share a full VPC; it shares subnets within a VPC. Also, sharing the entire VPC would give workload accounts broad network modification permissions, which contradicts the requirement that the network operations team centrally manages the environment.

Why Option E Is Correct

Option E completes the dual-stack internet path. An internet gateway provides IPv4 and IPv6 internet access for resources in public subnets. An egress-only internet gateway is the IPv6 equivalent of a NAT gateway: it allows resources in private subnets to initiate IPv6 outbound connections but prevents inbound IPv6 connections. For IPv4 private subnets, NAT gateways are deployed in public subnets and provide outbound-only IPv4 access. The route tables must be updated so that public subnets route 0.0.0.0/0 and ::/0 to the internet gateway, while private subnets route IPv4 through the NAT gateway and IPv6 through the egress-only internet gateway. Option E captures these components, and the phrase “egress-only internal gateway” is simply a slight misnomer for the AWS egress-only internet gateway.

Why the Other Options Are Wrong

• Option A uses an invalid manual IPv6 address and is therefore incorrect, even though it correctly provisions /24 IPv4 and /64 IPv6 subnets.
• Option D incorrectly shares the VPC object rather than the subnets. AWS RAM's supported networking resource type is the subnet, not the complete VPC, and sharing the whole VPC would violate central control.

For the ANS-C01 exam, remember that a well-architected multi-account VPC design uses subnet-level sharing with AWS RAM, automatically assigned IPv6 blocks, and the correct combination of internet gateways, egress-only internet gateways, and NAT gateways.