How to Connect Two Transit Gateways in the Same Region Across Accounts?

A company has agreed to collaborate with a partner for a research project. The company has multiple VPCs in the us-east-1 Region that use CIDR blocks within 10.10.0.0/16. The VPCs are connected by a transit gateway that is named TGW-C in us-east-1. TGW-C has an Autonomous System Number (ASN) configuration value of 64520. The partner has multiple VPCs in us-east-1 that use CIDR blocks within 172.16.0.0/16. The VPCs are connected by a transit gateway that is named TGW-P in us-east-1. TGW-P has an ASN configuration value of 64530. A network engineer needs to establish network connectivity between the company's VPCs and the partner's VPCs in us-east-1. Which solution will meet these requirements with MINIMUM changes to both networks?

Create a new VPC in a new account. Deploy a router from AWS Marketplace. Share TGW-C and TGW-P with the new account by using AWS Resource Access Manager (AWS RAM). Associate TGW-C and TGW-P with the new VPC. Configure the router in the new VPC to route between TGW-C and TGW-P.
Create an IPsec VPN connection between TGW-C and TGW-P. Configure the routing between the transit gateways to use the IPsec VPN connection.
Configure a cross-account transit gateway peering attachment between TGW-C and TGW-P. Configure the routing between the transit gateways to use the peering attachment. Source Reference Answer
Share TGW-C with the partner account by using AWS Resource Access Manager (AWS RAM). Associate the partner VPCs with TGW-C. Configure routing in the partner VPCs and TGW-C.

Community Votes

100%

100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

This question tests whether candidates know that transit gateway peering attachments work both across regions AND across accounts within the same region, and that peering is the least disruptive option when both sides already have existing TGW architectures.

To connect two transit gateways belonging to different AWS accounts within the same region with minimal changes, use a cross-account transit gateway peering attachment. This avoids redesigning VPC associations or introducing third-party routing appliances.

Many candidates choose Option D (sharing TGW-C via RAM and attaching partner VPCs directly) because RAM sharing is a common pattern, but this requires the partner to detach their VPCs from TGW-P and re-associate them with TGW-C, which violates the 'minimum changes' constraint and breaks the partner's existing network design.

Community Discussion (6 comments)

psou7 👍 6

I vote for C https://repost.aws/questions/QUbU0rsbkYTPKWHqYT0nIAEA/transit-gateway-peering-cross-accounts-not-sharing-payer-id

Spaurito 👍 1

C - You can peer into an opt-in Region as long as the account that accepts the peering attachment has opted into that Region.

Spaurito 👍 1

C - The task is to establish connectivity between the 2 companies and their VPC's. Option D - Although you could use (RAM), it doesn't define they would be sharing resources.

cas_tori 👍 1 Selected: C

this is C

amamatsumoto9 👍 1

I think it's D. Because transit gateways are not normally peered within a region, but rather peered across regions.

rdiaz 👍 2 Selected: C

c transit gw cross account sharing

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Understanding the Scenario

The company and its partner each have their own transit gateway (TGW-C and TGW-P) in the us-east-1 region, with VPCs already attached to their respective TGWs. The goal is to establish connectivity between the two networks with minimum changes to both sides.

Why Option C is Correct

Transit gateway peering attachments support both cross-region and cross-account connectivity. A cross-account peering attachment between TGW-C and TGW-P allows routes to be exchanged between the two gateways without requiring either side to detach their existing VPC attachments or redesign their network architecture. Each TGW simply adds a route pointing to the peering attachment for the other side's CIDR blocks.

Key benefits of this approach:

No changes to existing VPC attachments on either side
No need to share TGWs via RAM, which would require re-associating VPCs
No third-party appliances needed
Works within the same region as well as across regions

Why the Other Options Are Wrong

Option A introduces an entirely new VPC, a new account, a third-party router from AWS Marketplace, and RAM sharing of both TGWs. This is the most complex and costly solution, clearly violating the "minimum changes" requirement.

Option B suggests an IPsec VPN connection between the two TGWs. While technically possible (by attaching a VPN to each TGW and connecting them), this adds unnecessary complexity, requires managing VPN appliances or AWS Site-to-Site VPN connections, and is not the native or simplest way to peer two TGWs.

Option D proposes sharing TGW-C with the partner via RAM and associating the partner's VPCs directly to TGW-C. This would require the partner to detach their VPCs from TGW-P and re-associate them with TGW-C, which is a significant change to the partner's network. Additionally, it does not establish connectivity between the two TGWs themselves—it merges the partner's VPCs into the company's TGW, which is not the intended architecture.

Community Consensus

The community overwhelmingly supports Option C (100% of votes). Candidates note that transit gateway peering is the standard, least-disruptive method for connecting two independently managed TGWs, whether in the same region or across regions. One commenter correctly pointed out that peering works even within the same region, dispelling the misconception that TGW peering is only for cross-region scenarios.

Official Reference

Exam Strategy

When an AWS networking question emphasizes 'minimum changes' and both sides already have transit gateways, always look for the transit gateway peering option first. Eliminate answers that require detaching VPCs, introducing third-party appliances, or merging network architectures.

Related Analysis

Practice All ANS-C01 Questions

Access 137 questions with complete answers and detailed explanations.

View Full ANS-C01 Practice Test →

← Back to ANS-C01 Study Guide