SAP-C02 · Question #262
A company is using multiple AWS accounts. The company has a shared service account and several other accounts for different projects. A team has a VPC in a project account. The team wants to connect…
The correct answer is A. Deploy the Lambda function to the project account. C. Add a custom resource to the CloudFormation networking stack that references the Lambda E. Create a cross-account IAM role in the shared services account that grants the sts:AssumeRole. Project Account: a lambda function to: - Create an associate from VPG to the DX Gateway ID (input DX Gateway Owner) (answer A, need directconnect: permission to do this) - Assume role on Share Service account to accept the association request. Share Service account: - an IAM…
Question
A company is using multiple AWS accounts. The company has a shared service account and several other accounts for different projects. A team has a VPC in a project account. The team wants to connect this VPC to a corporate network through an AWS Direct Connect gateway that exists in the shared services account. The team wants to automatically perform a virtual private gateway association with the Direct Connect gateway by using an already-tested AWS Lambda function while deploying its VPC networking stack. The Lambda function code can assume a role by using AWS Security Token Service (AWS STS). The team is using AWS CloudFormation to deploy its infrastructure. Which combination of steps will meet these requirements? (Choose three.)
Options
- ADeploy the Lambda function to the project account.
- BCreate a cross-account IAM role in the shared services account that grants the Lambda function
- CAdd a custom resource to the CloudFormation networking stack that references the Lambda
- DDeploy the Lambda function that is performing the association to the shared services account.
- ECreate a cross-account IAM role in the shared services account that grants the sts:AssumeRole
- FAdd a custom resource to the CloudFormation networking stack that references the Lambda
How the community answered
(53 responses)- A58% (31)
- B13% (7)
- D6% (3)
- F23% (12)
Explanation
Project Account: a lambda function to: - Create an associate from VPG to the DX Gateway ID (input DX Gateway Owner) (answer A, need directconnect:* permission to do this) - Assume role on Share Service account to accept the association request. Share Service account: - an IAM role to allow Project account's Lambda to assume with directconnect:* permission to allow acction accept/deny the request (answer E) https://docs.aws.amazon.com/directconnect/latest/UserGuide/multi-account-associate-vgw.html
Community Discussion
No community discussion yet for this question.