Share a Transit Gateway through AWS RAM for cross-account Aurora connectivity

SAP-C02 By islever Editorial Last updated

Architect network connectivity strategies. Design a multi-account AWS environment.

Short answer

B Share a Transit Gateway from the shared services account through AWS RAM so every account gets private connectivity to the Aurora cluster.

Question

A company uses AWS Organizations to manage its development environment. Each development team at the company has its own AWS account. Each account has a single VPC and CIDR blocks that do not overlap. The company has an Amazon Aurora DB cluster in a shared services account. All the development teams need to work with live data from the DB cluster. Which solution will provide the required connectivity to the DB cluster with the LEAST operational overhead?
  1. Create an AWS Resource Access Manager (AWS RAM) resource share for the DB cluster. Share the DB cluster with all the development accounts.
  2. Create a transit gateway in the shared services account. Create an AWS Resource Access Manager (AWS RAM) resource share for the transit gateway. Share the transit gateway with all the development accounts. Instruct the developers to accept the resource share. Configure networking. Correct Answer
  3. Create an Application Load Balancer (ALB) that points to the IP address of the DB cluster. Create an AWS PrivateLink endpoint service that uses the ALB. Add permissions to allow each development account to connect to the endpoint service.
  4. Create an AWS Site-to-Site VPN connection in the shared services account. Configure networking. Use AWS Marketplace VPN software in each development account to connect to the Site-to-Site VPN connection.

Key Takeaways

Aurora cannot be shared through AWS RAM, so RAM must be used to share the Transit Gateway itself and give every account a routed path into the shared services VPC.

Development teams in separate member accounts need live connectivity to a single Amazon Aurora DB cluster hosted in a shared services account. Because the accounts have non-overlapping CIDR blocks and one VPC each, the answer is a shared Transit Gateway rather than a VPC peering mesh.

Common mistake: Choosing a RAM resource share for the Aurora DB cluster. RAM can share many resources but an Aurora cluster is not a shareable resource type, and even a shared database does not provide the network path to it.

Expert Analysis

Why the Answer Is Correct

AWS RAM can share a Transit Gateway with member accounts, and every accepting account is automatically attached to the shared TGW, so developers get routed connectivity to the shared services VPC where the Aurora cluster lives. One shared TGW scales to many accounts with no peering mesh to maintain.

Why the Other Options Are Wrong

A: An Aurora DB cluster is not on the RAM shareable resource list, so a RAM share of the cluster is not possible. C: An ALB with a PrivateLink endpoint service would expose the database through a load balancer target, adding a network hop and losing the native database protocol path. D: A Site-to-Site VPN plus Marketplace VPN software in every account adds per-account tunnel management for a permanent connection.

Community Comment Notes

Several commenters initially chose A because the RAM shareable-resources page mentions Aurora, but the community consensus at 82 votes settled on B: RAM shares the Transit Gateway, not the database, and connectivity is what the requirement asks for.

Official Reference

https://docs.aws.amazon.com/ram/latest/userguide/shareable.html

This link opens the official vendor documentation in a new tab.

Community Votes

B
100%

100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 14 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 14

  1. matheusrdo 👍 10 Answered B
    The question asks about working with live data and providing CONNECTIVITY to the DB cluster. B is the correct as it provides both
  2. pangchn 👍 8 Answered B
    B I originally chose A since I thoughtAurora DB cluster is sharable https://docs.aws.amazon.com/ram/latest/userguide/shareable.html#shareable-aur But as Verri mentioned, with that share, it only allow you to CLONE the db rather than use it as live https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/Aurora.Managing.Clone.html#Aurora.Managing.Clone.Cross-Account
  3. VerRi 👍 7 Answered B
    A: Sharing DB cluster with RAM allows you to CLONE a shared, centrally managed DB cluster C: PrivateLink needs NLB not ALB D: WTF
  4. txxxxxf 👍 6 Answered B
    AWS PrivateLink requires an NLB (Network Load Balancer). Since the question mentions that IP addresses should not overlap, sharing via Transit Gateway might be a good approach.
  5. gustori99 👍 5 Answered B
    C is wrong because for Private Link you need to use NLB not ALB. Correct answer is B.
Show 9 more comments
  1. JOKERO 👍 4 Answered A
    https://docs.aws.amazon.com/ram/latest/userguide/shareable.html#shareable-aur
  2. CMMC 👍 1 Answered C
    Utilizing AWS PrivateLink to enable private connectivity between VPCs without the need for public IP addresses or internet gateways. Creating an ALB pointing to the DB cluster's IP address and then creating a PrivateLink endpoint service that uses the ALB allows each development account to securely connect to the DB cluster. This approach minimizes operational overhead and simplifies network connectivity.
  3. red_panda 👍 1 Answered A
    For me it's A. We need to use the RAM only for the Aurora DB. We don't need to peer the VPCs with TransitGateway. Also less ops effort is option A. So Option B is unuseful complicated.
  4. AzureDP900 👍 1
    Creating a transit gateway (Option B) can be an effective way to provide connectivity to your Amazon Aurora DB cluster while minimizing operational overhead.
  5. mav3r1ck 👍 1 Answered A
    LEAST operational overhead is "A". You can share DB Cluster. https://docs.aws.amazon.com/ram/latest/userguide/shareable.html#shareable-aur
  6. pangchn 👍 1 Answered A
    I will go for A as the ref link provided by JOKERO if not, the transit gateway would be ideal too.
  7. spencer_sharp 👍 1 Answered A
    Seemed A since B requires a lot setup work
  8. titi_r 👍 3 Answered B
    Correct ans "B".
  9. vip2 👍 1 Answered B
    for live data, it should be B

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Modernize centralized firewall appliances with a Gateway Load Balancer and Auto Scaling

S-grade

Use Lambda over a CloudWatch Logs stream to count unique users per client

S-grade

Serve global game assets with Route 53 latency records and health checks

S-grade

Reach a cross-account S3 data lake through a gateway endpoint and an access point bucket policy

S-grade

Practice All SAP-C02 Questions

Access 85 questions with complete answers and detailed explanations.

View Full SAP-C02 Practice Test →

← Back to SAP-C02 Study Guide