How to Connect Two Transit Gateways in the Same Region Across Accounts?

ANS-C01 By islever Editorial Last updated

Short answer

C Configure a cross-account transit gateway peering attachment between TGW-C and TGW-P. Configure the routing between the transit gateways to use the peering attachment.

Question

A company has agreed to collaborate with a partner for a research project. The company has multiple VPCs in the us-east-1 Region that use CIDR blocks within 10.10.0.0/16. The VPCs are connected by a transit gateway that is named TGW-C in us-east-1. TGW-C has an Autonomous System Number (ASN) configuration value of 64520. The partner has multiple VPCs in us-east-1 that use CIDR blocks within 172.16.0.0/16. The VPCs are connected by a transit gateway that is named TGW-P in us-east-1. TGW-P has an ASN configuration value of 64530. A network engineer needs to establish network connectivity between the company's VPCs and the partner's VPCs in us-east-1. Which solution will meet these requirements with MINIMUM changes to both networks?
  1. Create a new VPC in a new account. Deploy a router from AWS Marketplace. Share TGW-C and TGW-P with the new account by using AWS Resource Access Manager (AWS RAM). Associate TGW-C and TGW-P with the new VPC. Configure the router in the new VPC to route between TGW-C and TGW-P.
  2. Create an IPsec VPN connection between TGW-C and TGW-P. Configure the routing between the transit gateways to use the IPsec VPN connection.
  3. Configure a cross-account transit gateway peering attachment between TGW-C and TGW-P. Configure the routing between the transit gateways to use the peering attachment. Correct Answer
  4. Share TGW-C with the partner account by using AWS Resource Access Manager (AWS RAM). Associate the partner VPCs with TGW-C. Configure routing in the partner VPCs and TGW-C.

Key Takeaways

This question tests whether candidates know that transit gateway peering attachments work both across regions AND across accounts within the same region, and that peering is the least disruptive option when both sides already have existing TGW architectures.

To connect two transit gateways belonging to different AWS accounts within the same region with minimal changes, use a cross-account transit gateway peering attachment. This avoids redesigning VPC associations or introducing third-party routing appliances.

Common mistake: Many candidates choose Option D (sharing TGW-C via RAM and attaching partner VPCs directly) because RAM sharing is a common pattern, but this requires the partner to detach their VPCs from TGW-P and re-associate them with TGW-C, which violates the 'minimum changes' constraint and breaks the partner's existing network design.

Expert Analysis

Understanding the Scenario

The company and its partner each have their own transit gateway (TGW-C and TGW-P) in the us-east-1 region, with VPCs already attached to their respective TGWs. The goal is to establish connectivity between the two networks with minimum changes to both sides.

Why Option C is Correct

Transit gateway peering attachments support both cross-region and cross-account connectivity. A cross-account peering attachment between TGW-C and TGW-P allows routes to be exchanged between the two gateways without requiring either side to detach their existing VPC attachments or redesign their network architecture. Each TGW simply adds a route pointing to the peering attachment for the other side's CIDR blocks.

Key benefits of this approach:

  • No changes to existing VPC attachments on either side
  • No need to share TGWs via RAM, which would require re-associating VPCs
  • No third-party appliances needed
  • Works within the same region as well as across regions

Why the Other Options Are Wrong

Option A introduces an entirely new VPC, a new account, a third-party router from AWS Marketplace, and RAM sharing of both TGWs. This is the most complex and costly solution, clearly violating the "minimum changes" requirement.

Option B suggests an IPsec VPN connection between the two TGWs. While technically possible (by attaching a VPN to each TGW and connecting them), this adds unnecessary complexity, requires managing VPN appliances or AWS Site-to-Site VPN connections, and is not the native or simplest way to peer two TGWs.

Option D proposes sharing TGW-C with the partner via RAM and associating the partner's VPCs directly to TGW-C. This would require the partner to detach their VPCs from TGW-P and re-associate them with TGW-C, which is a significant change to the partner's network. Additionally, it does not establish connectivity between the two TGWs themselves—it merges the partner's VPCs into the company's TGW, which is not the intended architecture.

Community Consensus

The community overwhelmingly supports Option C (100% of votes). Candidates note that transit gateway peering is the standard, least-disruptive method for connecting two independently managed TGWs, whether in the same region or across regions. One commenter correctly pointed out that peering works even within the same region, dispelling the misconception that TGW peering is only for cross-region scenarios.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When an AWS networking question emphasizes 'minimum changes' and both sides already have transit gateways, always look for the transit gateway peering option first. Eliminate answers that require detaching VPCs, introducing third-party appliances, or merging network architectures.

Community Votes

C
100%

100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 6 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 6

  1. psou7 👍 6
    I vote for C https://repost.aws/questions/QUbU0rsbkYTPKWHqYT0nIAEA/transit-gateway-peering-cross-accounts-not-sharing-payer-id
  2. rdiaz 👍 2 Answered C
    c transit gw cross account sharing
  3. Spaurito 👍 1
    C - The task is to establish connectivity between the 2 companies and their VPC's. Option D - Although you could use (RAM), it doesn't define they would be sharing resources.
  4. Spaurito 👍 1
    C - You can peer into an opt-in Region as long as the account that accepts the peering attachment has opted into that Region.
  5. amamatsumoto9 👍 1
    I think it's D. Because transit gateways are not normally peered within a region, but rather peered across regions.
Show 1 more comment
  1. cas_tori 👍 1 Answered C
    this is C

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

How to make one AWS Direct Connect connection primary and the other failover-only?

S-grade

How to Copy On-Premises Application Logs to Amazon S3 Over AWS Direct Connect?

S-grade

Why Does VPC Traffic Mirroring Randomly Drop Traffic?

S-grade

What is the most secure way to expose cross-account microservices with API Gateway?

S-grade

Practice All ANS-C01 Questions

Access 137 questions with complete answers and detailed explanations.

View Full ANS-C01 Practice Test →

← Back to ANS-C01 Study Guide