A central network account owns VPCs. Application accounts must deploy workloads INTO those subnets without duplicating networking per account. Which service shares subnets across the organization?
A.VPC peering between accounts
Peering links VPCs — doesn't let others deploy INTO your subnets.
B.AWS Resource Access Manager (RAM) sharing subnets with member accounts
Correct. RAM = cross-account resource sharing.
C.Transit Gateway attachments
TGW routes traffic between networks — same distinction.
D.Copying the CloudFormation template into each account
Duplicated networking defeats centralized control.
Why this answer
RAM is the sharing layer — subnets, TGWs, License Manager configs, etc. get shared so member accounts deploy into centrally owned networking while keeping their own workloads isolated. Peering and TGW connect networks; RAM shares the infrastructure itself.
Correct answer: B · Last reviewed 2026-11-03
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Multi-Account Architecture practice session.
Practice Multi-Account Architecture