Which combination of actions should the solutions architect perform to meet these requirements?
(Choose two.)
Create a transit gateway in the infrastructure account.
Enable resource sharing from the AWS Organizations management account.
Create VPCs in each AWS account within the organization in AWS Organizations. Configure the VPCs to share the same CIDR range and subnets as the VPC in the infrastructure account. Peer the VPCs in each individual account with the VPC in the infrastructure account.
Create a resource share in AWS Resource Access Manager in the infrastructure account. Select the specific AWS Organizations OU that will use the shared network. Select each subnet to associate with the resource share.
Create a resource share in AWS Resource Access Manager in the infrastructure account. Select the specific AWS Organizations OU that will use the shared network. Select each prefix list to associate with the resource share.
Explanations:
While creating a transit gateway in the infrastructure account is a common practice for managing network traffic between multiple VPCs, it does not specifically address the requirement of allowing individual accounts to create resources within subnets while maintaining centralized network management.
Enabling resource sharing from the AWS Organizations management account allows for the sharing of resources such as subnets across accounts in the organization. This is essential for meeting the requirement of allowing individual accounts to create AWS resources within shared subnets while maintaining control in the infrastructure account.
Creating VPCs in each AWS account and configuring them to share the same CIDR range and subnets is not compliant with the requirement that individual accounts should not manage their own networks. This approach would contradict the need for centralized network management in the infrastructure account.
Creating a resource share in AWS Resource Access Manager (RAM) in the infrastructure account and selecting specific subnets to associate with the resource share allows individual accounts to utilize the subnets in the infrastructure account. This setup enables resource creation within the managed network while keeping network management centralized.
While associating a prefix list with a resource share in AWS RAM is a method for sharing network resources, it does not fulfill the requirement of allowing individual accounts to create AWS resources within specific subnets. The focus needs to be on sharing actual subnets rather than just prefix lists, which do not provide the needed subnet access for resource creation.