VPC Sharing
What Is VPC Sharing?
VPC sharing allows multiple accounts to create and manage cloud resources, such as ECSs, load balancers, and RDS instances, in one VPC. With Resource Access Manager (RAM), you can share subnets in a VPC with one or more accounts so you can centrally manage resources in multiple accounts, which improves resource management efficiency and reduces O&M costs.
- Account A: IT management account of the enterprise and the owner of the VPC and subnets.
Account A creates a VPC and four subnets and shares these subnets with other accounts. Account A creates resources in Subnet-01.
- Account B: service account of the enterprise and the principal of the shared subnet. Account B creates resources in Subnet-02.
- Account C: service account of the enterprise and the principal of the shared subnet. Account C creates resources in Subnet-03.
- Account D: service account of the enterprise and the principal of the shared subnet. Account D creates resources in Subnet-04.
![](https://support.huaweicloud.com/intl/en-us/usermanual-vpc/public_sys-resources/notice_3.0-en-us.png)
The subnets of the owner and those of the principals are in the same VPC, so resources in these subnets can communicate with each other by default. However, if the resources in the subnets are associated with different security groups, the resources are isolated from each other. If you want the resources to communicate with each other, you need to add security group rules by referring to Adding a Security Group Rule.
For example, to allow ECSs in accounts A and B to communicate with each other, you need to add inbound rules to their security groups and set the source to the security group in the other account.
Advantages
- There are multiple accounts, such as network accounts, security accounts, and service accounts. This makes cross-account resource O&M hard and time-consuming.
- The cross-account network configurations result in a complex networking structure, hard user operations, and low efficiency.
To deal with these problems, you can share subnets with multiple accounts. You can organize accounts in an orderly and centralized manner based on organization structure or business model.
- You can create subnets in a VPC under an account and share the subnets with principals. In this way, principals do not need to create VPCs and subnets. Fewer resources and simplified network architecture improves management efficiency and reduces costs.
If there are VPCs in different accounts, VPC peering connections are required for mutual communications among VPCs. With VPC sharing, different accounts can create resources in one VPC. This eliminates the need for configuring VPC peering connections and simplifies the network structure.
- Resources can be centrally managed in one account, which helps enterprises configure service security policies in a centralized manner and better monitor and audit resource usage for higher security.
Process for Sharing a Subnet
Before sharing a subnet, you need to enable the RAM service in your account. For details, see Resource Access Manager User Guide.
As the owner of VPC subnets, you can share the subnets with other accounts. Principals need to accept the sharing requests before they use the subnets. Figure 2 shows the process of sharing a subnet.
You can share a subnet on the RAM or VPC console. For details, see Table 1.
Method |
Description |
Reference |
---|---|---|
Method A |
|
|
Method B |
|
Operation Permissions on a Shared Subnet
The owner and principals of a shared subnet have different operation permissions on the subnet and associated resources. For details, see Table 2.
Role |
When a Share Is Accepted |
When a Share Is Stopped |
When the Principals Leave a Share |
---|---|---|---|
Owner |
|
|
|
Principal |
|
Uses the existing resources created by themselves, but cannot create resources in the shared subnet. |
Uses the existing resources created by themselves, but cannot create resources in the shared subnet. |
Resource |
Owner |
Principal |
---|---|---|
VPC |
Has all operation permissions on the VPC of a shared subnet. |
Only can view the VPC that the shared subnet belongs to, but cannot perform any operations on the VPC. |
Subnet |
Has all operation permissions on the shared subnet and can view the virtual IP addresses and network interfaces in the shared subnet. |
Only can view the shared subnet, but cannot:
Can assign virtual IP addresses and network interfaces in the subnet. |
Route table |
Has all operation permissions on the route table. |
|
Network ACL |
Has all operation permissions on the network ACL. |
|
Security group |
|
|
IP address group |
IP address groups are independent of each other. Owners can create an IP address group and associate it with their own security groups. |
IP address groups are independent of each other. Principals can create an IP address group and associate it with their own security groups. |
VPC flow log |
|
Can create a flow log with Resource Type set to NIC. Traffic on all network interfaces of the principal will be recorded in this flow log. |
VPC peering connection |
Selects the VPC with subnets shared with other accounts to create a VPC peering connection. |
Cannot select the VPC with subnets shared with other accounts to create a VPC peering connection. |
NAT gateway |
Creates and manages NAT gateways in the shared subnet. |
Cannot create NAT gateways in the shared subnet. |
VPN gateway |
Creates and manages VPN gateways in the shared subnet. |
Cannot create VPN gateways in the shared subnet. |
Enterprise router |
Attaches the VPC with subnets shared with other accounts to an enterprise router. |
Cannot attach the VPC with subnets shared with other accounts to an enterprise router. |
Enterprise switch |
Creates and manages enterprise switches in the shared subnet. |
Cannot create enterprise switches in the shared subnet. |
Direct Connect connection |
Creates and manages Direct Connect connections in the shared subnet. |
Cannot create Direct Connect connections in the shared subnet. |
Cloud connection |
Loads the VPC with subnets shared with other accounts to a cloud connection. |
Cannot load the VPC with subnets shared with other accounts to a cloud connection. |
VPC endpoint |
Creates and manages VPC endpoints in the shared subnet. |
Cannot create VPC endpoints in the shared subnet. |
Tag |
Adds and manages tags in the shared subnet. |
Cannot add tags in the shared subnet. |
Billing
You only need to pay for the resources (such as ECSs, load balancers, and RDS instances) you create in the shared subnets. For details, see the billing description of each cloud resource.
Quotas
Notes and Constraints
- A principal can receive a maximum of 100 subnet shares.
- A subnet can be shared with a maximum of 100 principals.
- The following cloud resources can be created in a shared subnet:
- ECSs
- BMSs
- Dedicated load balancers
- CCE turbo clusters
- API gateways
- Kafka instances
- ServiceStage environments
- ServiceComb engines
- FunctionGraph functions
- GaussDB instances
- GaussDB(for MySQL) instances
- GeminiDB Influx instances
- GeminiDB Redis instances
- GeminiDB Cassandra instances
- RDS for MySQL instances
- RDS for PostgreSQL instances
- DDS cluster instances
- Dedicated HSM instances
- Database audit instances
- CBH instances
- GaussDB(DWS) instances
- DataArts Studio instances
- CSS clusters
- Network connections between DLI and resources
- CDM clusters
Feedback
Was this page helpful?
Provide feedbackThank you very much for your feedback. We will continue working to improve the documentation.See the reply and handling status in My Cloud VOC.
For any further questions, feel free to contact us through the chatbot.
Chatbot