Shared services (DNS, security inspection, logging collectors) must be reachable from 100+ workload VPCs across accounts. What's the scalable way to provide centralized shared services?
A.VPC peering from every workload VPC to a shared services VPC
Peering meshes become unmanageable and non-transitive at 100+ VPCs.
B.A shared services VPC attached to a Transit Gateway, with all workload VPCs attached
Correct. TGW + shared-services VPC is the canonical enterprise pattern.
C.Duplicate shared services in every VPC
Duplication multiplies cost, patching, and drift across 100 environments.
D.Make services public behind CloudFront
Exposing internal services publicly adds attack surface without solving routing.
Why this answer
At scale, Transit Gateway with a dedicated shared-services VPC is the standard pattern: every workload VPC attaches to the TGW hub, which routes to shared services — avoiding a 100-way peering mesh and duplication.
Correct answer: B · Last reviewed 2026-10-26
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Multi-Account Architecture practice session.
Practice Multi-Account Architecture