A network engineer is migrating from an on-premises data center to an AWS Control Tower multi-account environment. A Transit Gateway exists in a central network services account and is shared with the Organization using AWS RAM. A shared services account hosts workloads that must be available organization-wide. The engineer needs to automate creation of common network components: provision a VPC for application workloads in each new and existing member account and connect those VPCs to the Transit Gateway in the central account. Which combination of steps will achieve this with the least operational overhead? (Choose three.)

The correct options leverage AWS Control Tower's Account Factory Customization (AFC) feature for automated, consistent provisioning. AFC allows you to define a baseline for new and existing accounts, ensuring that the required VPC and Transit Gateway attachments are created. This is achieved by using an AWS CloudFormation template, uploaded as an AWS Service Catalog product, which defines the network infrastructure. The AWSControlTowerBlueprintAccess role is essential for AFC to assume permissions in member accounts and deploy the CloudFormation stacks. The incorrect options introduce unnecessary complexity or do not align with Control Tower's native automation capabilities. A Lambda function with an EventBridge rule could work but requires more custom development and maintenance compared to AFC. AFC is designed specifically for this type of multi-account provisioning within Control Tower, offering lower operational overhead.