Question

A large enterprise runs a multi-account AWS Organization managed with Control Tower. A dedicated Network account owns a Transit Gateway and several centralized VPCs. The cloud platform team wants application account owners to attach their own VPCs to the shared Transit Gateway without being able to modify Transit Gateway route tables, delete the Transit Gateway, or share it further with external accounts. Application accounts must be able to create attachments only. Which approach BEST enforces this while allowing self-service attachment?

Accepted Answer

Share the Transit Gateway with the organization via AWS RAM, and apply an SCP on the application accounts' OU that denies transit-gateway route table modification, deletion, and RAM sharing actions while allowing CreateTransitGatewayVpcAttachment.

Answer

Create a cross-account IAM role in the Network account that application teams assume to attach their VPCs, granting full ec2 Transit Gateway permissions in that role.

Answer

Use VPC peering between each application VPC and the centralized VPCs, and restrict route table edits with an SCP denying ec2:CreateRoute on the application accounts.

Answer

Share the Transit Gateway via AWS RAM with each account individually, and rely on RAM resource share permissions alone to prevent route table and deletion actions.