A retail organization uses AWS Organizations with 40 workload accounts and a shared services account hosting a central Transit Gateway and inspection VPC. Workload VPCs must use centralized egress and share a common product image catalog without copying AMIs. Which cross-account resource sharing design centralizes networking and catalog access?
Select an answer to reveal the explanation.
Short Explanation
You want one front door and one library everyone borrows from. AWS RAM shares the transit hub, and organization-wide AMI sharing lends out the images without messy copies.
Full Explanation
The correct design works because sharing the central Transit Gateway through AWS RAM lets workload VPCs in the 40 accounts attach as spokes, with route tables sending egress to the inspection VPC for consistent filtering and logging. Golden AMIs are shared by adding the organization or OU as a launch permission on the AMI, so every account can launch the single versioned image without copying it; encrypted AMIs also need the KMS key shared. Copying AMIs into each account violates the no-copy requirement and creates stale versions. Making AMIs public exposes the company image to everyone and ignores governance. Local NAT gateways per VPC bypass the central inspection VPC and lose centralized egress control. Exam caveat: AWS RAM shares network constructs such as Transit Gateway and subnets, while AMIs are shared through launch permissions (including organization and OU principals), and Transit Gateway and AMIs are Regional resources. Before implementation, verify organization sharing is enabled in RAM, attachment acceptance, Transit Gateway route tables pointing default routes to inspection, and test launching the shared image from a member account.