A large enterprise runs workloads in VPCs across hundreds of AWS accounts. Each VPC has public and private subnets across multiple AZs; NAT gateways in public subnets provide internet access for private subnets. In a hub-and-spoke design, all private subnets in spoke VPCs must send internet-bound traffic through a NAT gateway located in a centralized egress VPC in a central account. A NAT gateway already exists in that egress VPC. Which additional steps should the solutions architect take to meet the requirement?

AWS Transit Gateway is the most scalable and manageable solution for connecting hundreds of VPCs in a hub-and-spoke architecture. By attaching all spoke VPCs and the egress VPC to a central Transit Gateway, routing can be configured to direct all internet-bound traffic from spoke VPCs to the NAT Gateway in the egress VPC. This centralizes internet egress, simplifying network management and security. VPC peering is not suitable for this scale as it requires N(N-1)/2 connections for N VPCs, quickly becoming unmanageable and exceeding limits. Creating a Transit Gateway in every account is redundant and complex, defeating the purpose of centralized egress. AWS PrivateLink is designed for private, one-way connectivity to services, not for general internet egress from VPCs.