Share a Transit Gateway through AWS RAM for cross-account Aurora connectivity

Architect network connectivity strategies. Design a multi-account AWS environment.

Answer Correct answer: B — Share a Transit Gateway from the shared services account through AWS RAM so every account gets private connectivity to the Aurora cluster.

A company uses AWS Organizations to manage its development environment. Each development team at the company has its own AWS account. Each account has a single VPC and CIDR blocks that do not overlap. The company has an Amazon Aurora DB cluster in a shared services account. All the development teams need to work with live data from the DB cluster. Which solution will provide the required connectivity to the DB cluster with the LEAST operational overhead?

Create an AWS Resource Access Manager (AWS RAM) resource share for the DB cluster. Share the DB cluster with all the development accounts.
Create a transit gateway in the shared services account. Create an AWS Resource Access Manager (AWS RAM) resource share for the transit gateway. Share the transit gateway with all the development accounts. Instruct the developers to accept the resource share. Configure networking. Correct Answer
Create an Application Load Balancer (ALB) that points to the IP address of the DB cluster. Create an AWS PrivateLink endpoint service that uses the ALB. Add permissions to allow each development account to connect to the endpoint service.
Create an AWS Site-to-Site VPN connection in the shared services account. Configure networking. Use AWS Marketplace VPN software in each development account to connect to the Site-to-Site VPN connection.

Community Votes

100%

100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

Aurora cannot be shared through AWS RAM, so RAM must be used to share the Transit Gateway itself and give every account a routed path into the shared services VPC.

Development teams in separate member accounts need live connectivity to a single Amazon Aurora DB cluster hosted in a shared services account. Because the accounts have non-overlapping CIDR blocks and one VPC each, the answer is a shared Transit Gateway rather than a VPC peering mesh.

Choosing a RAM resource share for the Aurora DB cluster. RAM can share many resources but an Aurora cluster is not a shareable resource type, and even a shared database does not provide the network path to it.

Community Discussion (14 comments)

matheusrdo 👍 10 Selected: B

The question asks about working with live data and providing CONNECTIVITY to the DB cluster. B is the correct as it provides both

pangchn 👍 8 Selected: B

B I originally chose A since I thoughtAurora DB cluster is sharable https://docs.aws.amazon.com/ram/latest/userguide/shareable.html#shareable-aur But as Verri mentioned, with that share, it only allow you to CLONE the db rather than use it as live https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/Aurora.Managing.Clone.html#Aurora.Managing.Clone.Cross-Account

AzureDP900 👍 1

Creating a transit gateway (Option B) can be an effective way to provide connectivity to your Amazon Aurora DB cluster while minimizing operational overhead.

vip2 👍 1 Selected: B

for live data, it should be B

red_panda 👍 1 Selected: A

For me it's A. We need to use the RAM only for the Aurora DB. We don't need to peer the VPCs with TransitGateway. Also less ops effort is option A. So Option B is unuseful complicated.

titi_r 👍 3 Selected: B

Correct ans "B".

spencer_sharp 👍 1 Selected: A

Seemed A since B requires a lot setup work

mav3r1ck 👍 1 Selected: A

LEAST operational overhead is "A". You can share DB Cluster. https://docs.aws.amazon.com/ram/latest/userguide/shareable.html#shareable-aur

VerRi 👍 7 Selected: B

A: Sharing DB cluster with RAM allows you to CLONE a shared, centrally managed DB cluster C: PrivateLink needs NLB not ALB D: WTF

pangchn 👍 1 Selected: A

I will go for A as the ref link provided by JOKERO if not, the transit gateway would be ideal too.

gustori99 👍 5 Selected: B

C is wrong because for Private Link you need to use NLB not ALB. Correct answer is B.

JOKERO 👍 4 Selected: A

https://docs.aws.amazon.com/ram/latest/userguide/shareable.html#shareable-aur

txxxxxf 👍 6 Selected: B

AWS PrivateLink requires an NLB (Network Load Balancer). Since the question mentions that IP addresses should not overlap, sharing via Transit Gateway might be a good approach.

CMMC 👍 1 Selected: C

Utilizing AWS PrivateLink to enable private connectivity between VPCs without the need for public IP addresses or internet gateways. Creating an ALB pointing to the DB cluster's IP address and then creating a PrivateLink endpoint service that uses the ALB allows each development account to securely connect to the DB cluster. This approach minimizes operational overhead and simplifies network connectivity.

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Why the Answer Is Correct

AWS RAM can share a Transit Gateway with member accounts, and every accepting account is automatically attached to the shared TGW, so developers get routed connectivity to the shared services VPC where the Aurora cluster lives. One shared TGW scales to many accounts with no peering mesh to maintain.

Why the Other Options Are Wrong

A: An Aurora DB cluster is not on the RAM shareable resource list, so a RAM share of the cluster is not possible. C: An ALB with a PrivateLink endpoint service would expose the database through a load balancer target, adding a network hop and losing the native database protocol path. D: A Site-to-Site VPN plus Marketplace VPN software in every account adds per-account tunnel management for a permanent connection.

Community Comment Notes

Several commenters initially chose A because the RAM shareable-resources page mentions Aurora, but the community consensus at 82 votes settled on B: RAM shares the Transit Gateway, not the database, and connectivity is what the requirement asks for.

Official Reference

https://docs.aws.amazon.com/ram/latest/userguide/shareable.html

Related Analysis

Practice All SAP-C02 Questions

Access 85 questions with complete answers and detailed explanations.

View Full SAP-C02 Practice Test →

← Back to SAP-C02 Study Guide