A company uses AWS Organizations with three organizational units (OUs). Each OU contains over 100 accounts. Every account has a single VPC in the same Region per OU, and none of the VPC CIDR ranges overlap. The requirement is that VPCs within the same OU can communicate with each other, but VPCs in different OUs cannot. Which solution accomplishes this with the LEAST operational overhead?

The correct solution leverages AWS Transit Gateway, which is designed for centralizing network connectivity for many VPCs and on-premises networks. By deploying one Transit Gateway per OU and sharing it via AWS RAM, all VPCs within that OU can connect to it, enabling communication among them. This approach minimizes operational overhead because Transit Gateway manages routing centrally, avoiding the need for numerous individual peering connections. The isolation between OUs is maintained as each OU has its own Transit Gateway. VPC peering (Option A) would create an N-squared problem, requiring a large number of individual connections and complex routing tables for over 100 accounts per OU, leading to high operational overhead. Sharing a single VPC (Option B) isn't practical for inter-VPC communication within an OU; AWS RAM shares subnets, not entire VPCs for routing between distinct VPCs. VPN connections with third-party software (Option D) introduce significant complexity, licensing costs, and operational overhead compared to a native AWS service like Transit Gateway.