An organization uses AWS Organizations with eight member accounts and anticipates a maximum of 20 accounts. The company runs all workloads on AWS and has a new security policy requiring: • No account runs workloads in a VPC within that account. • All workloads must launch into subnets of a centrally managed VPC accessible by all accounts. • No account can modify another account’s application resources within the shared VPC. • The centrally managed VPC must reside in an existing account named Account-A in the organization. A CloudFormation template in Account-A creates the VPC and multiple subnets and exports the subnet IDs as stack outputs. Which solution completes the setup to satisfy these requirements?

AWS Resource Access Manager (AWS RAM) allows you to share AWS resources, including VPC subnets, with other AWS accounts or within your AWS Organization. This directly addresses the requirement for all workloads to launch into subnets of a centrally managed VPC in Account-A, while preventing member accounts from modifying Account-A's resources. Member accounts can then launch instances directly into these shared subnets. Using Fn::ImportValue in member accounts would only allow importing values, not sharing the actual subnets for resource deployment. A transit gateway connects VPCs, it doesn't enable launching resources directly into another VPC's subnets. VPC peering connects two VPCs, but doesn't allow one account to launch resources into the other's subnets directly; it's for network traffic routing.