A platform team must let 12 member accounts use a central Transit Gateway and shared application subnets without creating VPC peering meshes or duplicating gateways. It must preserve centralized routing with least-privilege access. Which control enables governed cross-account sharing for this network?

AWS RAM integrated with Organizations lets the central account share one Transit Gateway and designated application subnets with member accounts while the owner keeps control of the Transit Gateway route tables and attachment acceptance, delivering centralized routing with least-privilege without peering meshes or duplicate gateways. Peering a central Transit Gateway with a Transit Gateway in each member account for routing is valid for interconnecting separate domains, but fails by concept because it requires duplicate gateways and distributed routing contrary to the single-gateway constraint. Connecting member VPCs to central services privately using PrivateLink endpoint services is a standard least-privilege consumption pattern, but fails by concept because it publishes services rather than sharing subnet networks and transit connectivity for routed access. Granting member accounts delegated access to central VPCs using cross-account IAM roles is common for administration, but fails by concept because it delegates configuration permission without creating a governed resource share with ownership guardrails. Exam caveat is to separate sharing the network fabric from sharing a service or delegating admin rights when the stem specifies shared subnets plus one gateway. Practical check is to confirm RAM resource shares list the gateway and subnet ARNs for the member OU with propagation enabled and no extra gateways.