Question

A company operates a centralized networking account within AWS Organizations. The network team owns and manages a large VPC with carefully allocated subnets, NAT gateways, and route tables. Multiple application teams, each in their own AWS account, need to launch EC2 instances and RDS databases directly into these existing subnets so the network team can retain full control over IP addressing, routing, and network appliances. The solution must avoid duplicate networking infrastructure per account and must not require the application accounts to manage their own subnets or route tables. Which approach best meets these requirements?

Accepted Answer

Use AWS Resource Access Manager (RAM) to share the VPC subnets from the networking account with the participant application accounts, allowing them to launch resources into the shared subnets.

Answer

Establish VPC peering connections between each application account's VPC and the networking account's VPC, and propagate routes so applications can reach shared resources.

Answer

Create a Transit Gateway in the networking account, share it via RAM, and attach each application account's own VPC so traffic flows through a central hub.

Answer

Use AWS PrivateLink to expose the networking account's subnets as endpoint services that application accounts consume through interface endpoints.