An administrator would like VPCs in three different AWS accounts to access on-premise resources via a VPN connection terminating on a Transit Gateway. Each of the VPCs is in distinct AWS regions. How can this be achieved?

Answer options:

A.Use AWS Resource Access Manager (RAM) to share the Transit Gateway resource.
B.Configure a Virtual Private Gateway (VGW) for each VPC and then extend the VPN tunnels to them.
C.Create VPC attachments from each of the VPCs to the Transit Gateway.
D.Configure VPC peering connections between the VPCs and then route traffic from on-premise through the VPN to the Transit Gateway and then to each VPC peer.

Correct Answer: A
AWS Resource Access Manager (AWS RAM) allows AWS customers to share resources between multiple AWS accounts. In this scenario, it is possible to share the access to the Transit Gateway resource with the three AWS accounts, even if the VPCs are in distinct AWS regions.
https://docs.aws.amazon.com/ram/latest/userguide/what-is.html
Option B is INCORRECT because it is not possible to extend the VPN tunnels. In the scenario, the VPN tunnels terminate on the Transit Gateway in one of the AWS accounts.
Option C is INCORRECT because it cannot create VPC attachments without sharing the Transit Gateway resource.
Option D is INCORRECT because it has transitive routing connotations. This is not permissible in the AWS environment.