Using VPC sharing in a multi-account setup

What is VPC sharing in AWS, and how does it benefit a multi-account environment?

VPC sharing allows multiple AWS accounts to create their application resources, like EC2 instances, RDS databases, or Lambda functions, inside a centrally managed Virtual Private Cloud (VPC). This enables resource sharing while keeping the administrative ownership with the VPC owner account. The benefit is that it minimizes the number of VPCs to manage, ensures consistent security practices, and can potentially reduce costs by avoiding duplicate resources.

How does AWS enable VPC sharing across accounts?

AWS enables VPC sharing via the AWS Resource Access Manager (RAM) service, which allows you to share AWS resources with any AWS account or within your AWS Organization. When sharing a VPC, the VPC owner account shares one or more subnets with other AWS accounts, allowing those accounts to launch resources into a shared environment.

What are the prerequisites for setting up VPC sharing?

The prerequisites for VPC sharing include enabling AWS Resource Access Manager (RAM) within your organization, ensuring all accounts are part of the same AWS Organization, and that the Service Control Policies (SCPs) allow for VPC sharing. Additionally, the VPC must be associated with a CIDR block that doesn’t overlap with any other VPCs in the participant accounts.

Can you modify the Network Access Control Lists (NACLs) of a shared subnet? If so, who has the permissions to do this?

Only the owner account of the shared VPC can modify the Network Access Control Lists (NACLs) for the shared subnets. The participants in the shared VPC do not have the permissions to modify NACLs of the shared subnets as they do not have the ownership of the underlying VPC infrastructure.

When using VPC sharing, are there any limitations regarding Security Groups?

Yes, when using VPC sharing, one limitation is that participant accounts can only reference Security Groups that are shared with them or are within their own account. They cannot reference Security Groups from other VPCs that are not shared or owned by their account.

Describe the process of sharing a subnet within a VPC to other AWS accounts.

To share a subnet within a VPC, the owner account must first create the subnet in the VPC. Then, using AWS RAM, the owner account can share the desired subnet or subnets with other AWS accounts by creating a Resource Share and adding the AWS accounts as principals to the Resource Share. The participating accounts then accept the share, and can start launching resources in the shared subnet.

Are there any resources or services that cannot be used within shared subnets?

Most AWS services can be used within shared subnets, but certain services and features, such as VPC Peering connections, AWS Transit Gateway attachments, and AWS Direct Connect gateways, are restricted and cannot be used within shared subnets as they are tied to the VPC owner account.

How does DNS resolution work in a shared VPC setup?

DNS resolution in a shared VPC setup works the same way as in a regular VPC. Each account can manage its own private DNS within the shared VPC and can resolve public DNS names. However, if the VPC has a custom DNS server or Route 53 Resolver set up by the VPC owner account, it will affect all participating accounts in the shared VPC setup.

What happens to the resources within the shared subnet if the sharing invitation is revoked?

If the sharing invitation is revoked or if the participant account leaves the shared subnet, resources belonging to that account will remain running but will be unable to perform certain functions, such as launching new instances or modifying the VPC attributes. It’s recommended to migrate the necessary resources before revoking the sharing invitation to avoid disruption.

What is the difference between VPC peering and VPC sharing in terms of inter-account connectivity?

VPC peering is a networking connection between two VPCs, allowing instances within those VPCs to communicate with each other using private IP addresses. Each VPC in a VPC peering relationship remains separately managed and can exist in different accounts. In contrast, VPC sharing involves multiple AWS accounts launching resources into a single, centrally managed VPC, which allows for shared network resources and centralized governance but still requires separate management of application-level resources.

How do IAM policies affect VPC sharing in a multi-account setup?

IAM policies affect VPC sharing by determining what actions users and roles in the participating accounts can perform within the shared VPC. The VPC owner can set permissions that restrict the actions participants can perform, such as restricting the creation of certain resources or modifying VPC configurations. It’s crucial to carefully configure IAM policies to ensure security and proper access control in a multi-account setup.

Can you share a VPC with an account outside of your AWS Organization, and what considerations should be taken in such a case?

It is possible to share a VPC with an account outside of your AWS Organization using AWS Resource Access Manager (RAM). However, you must consider the trust relationship between the accounts, as sharing critical infrastructure like a VPC can pose security risks. Additionally, the VPC owner must manually share the VPC with external accounts (as opposed to automatic sharing within an organization), and explicitly accept resource shares from external accounts.