Question

A company runs a multi-account AWS Organizations setup with a dedicated Networking account that owns a central Transit Gateway. Application teams operate in separate member accounts, each with its own VPC. The networking team wants each application account to attach its VPCs to the central Transit Gateway without duplicating the Transit Gateway in every account, while keeping the Transit Gateway centrally managed. Application teams must be able to create their own attachments but must not be able to modify or delete the Transit Gateway itself. Which approach meets these requirements with the least operational overhead?

Accepted Answer

Share the Transit Gateway with the organization using AWS Resource Access Manager (RAM), then have each application account create Transit Gateway VPC attachments from their own accounts.

Answer

Create a Transit Gateway in each application account and establish Transit Gateway peering connections back to the central Transit Gateway in the Networking account.

Answer

Grant application teams a cross-account IAM role in the Networking account so they can create Transit Gateway attachments directly within the Networking account.

Answer

Establish VPC peering connections between each application VPC and a central VPC in the Networking account, then route through the Transit Gateway.